CVE-2026-33614: MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint
Published Apr 2, 2026
·Updated
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Affected Software
3 affected components
MB connect line mbCONNECT24
Mbconnectline Mbconnect24<=2.19.4
Mbconnectline Mymbconnect24<=2.19.4
Event History
Apr 2, 2026
CVE Published
via MITRE·08:59 AM
Data Sourced
via MITRE·08:59 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33614?
CVE-2026-33614 is classified as a high severity vulnerability due to its potential for unauthenticated remote exploitation.
2
How do I fix CVE-2026-33614?
To fix CVE-2026-33614, update the mbCONNECT24 software to version 2.19.5 or later.
3
What software is affected by CVE-2026-33614?
CVE-2026-33614 affects mbCONNECT24 versions up to and including 2.19.4.
4
Can CVE-2026-33614 be exploited remotely?
Yes, CVE-2026-33614 can be exploited remotely by an unauthenticated attacker.
5
What kind of attack is facilitated by CVE-2026-33614?
CVE-2026-33614 facilitates an unauthenticated SQL injection attack through the getinfo endpoint.