CVE-2026-40832

Vulnerability

The vulnerability is an unauthenticated SQL injection in the getDevicegroups function of MB connect line mbCONNECT24 and mymbCONNECT24 products [1]. Improper neutralization of special elements in a SQL SELECT command allows an attacker to inject arbitrary SQL queries. The affected versions are not explicitly listed in the available references, but the advisory [1] indicates multiple SQLi vulnerabilities exist in these products.

Exploitation

An attacker with network access to the vulnerable system can exploit this SQL injection without requiring authentication. The attacker sends a crafted request to the getDevicegroups endpoint containing malicious SQL syntax. No special privileges or user interaction is needed beyond network connectivity.

Impact

Successful exploitation results in the attacker being able to execute arbitrary SQL commands against the database. This leads to a total loss of confidentiality, as the attacker can retrieve any data stored in the database, including sensitive information.

Mitigation

As of the publication date (2026-05-27), no official patch or fixed version has been announced by MB connect line GmbH. Users are advised to monitor the vendor's advisory [1] and apply updates when they become available. No workarounds are documented in the available references.