CVE-2026-33615

The vulnerability results from improper neutralization of special characters in the SQL UPDATE command executed by the setinfo endpoint. An attacker can craft a malicious HTTP request containing dangerous character sequences that will be embedded directly in the SQL query without proper sanitization. Since the endpoint does not require authentication, exploitation is possible for anyone with network access to the device.

An attacker can manipulate or destroy data in the database (loss of integrity) and cause system unavailability (loss of availability). According to the description, the vulnerability results in complete loss of integrity and availability.

Patches available from the manufacturer should be applied in accordance with references (https://certvde.com/de/advisories/VDE-2026-030). Until the fix is implemented, it is recommended to restrict network access to the setinfo endpoint through a firewall or network segmentation so that devices are not accessible from untrusted networks.

Mbconnectline Mbconnect24 and Mbconnectline Mymbconnect24 — specific versions indicated in the manufacturer's references (VDE-2026-030).