CVE-2026-33615: MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint
Published Apr 2, 2026
·Updated
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.
Affected Software
3 affected components
MB connect line mbCONNECT24
Mbconnectline Mbconnect24<=2.19.4
Mbconnectline Mymbconnect24<=2.19.4
Event History
Apr 2, 2026
CVE Published
via MITRE·08:59 AM
Data Sourced
via MITRE·08:59 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33615?
CVE-2026-33615 is classified as a high severity SQL injection vulnerability.
2
How do I fix CVE-2026-33615?
To fix CVE-2026-33615, update the mbCONNECT24 software to version 2.19.5 or later.
3
What type of attack is associated with CVE-2026-33615?
CVE-2026-33615 is associated with an unauthenticated SQL injection attack.
4
What is affected by CVE-2026-33615?
CVE-2026-33615 affects the mbCONNECT24 and MyMBCONNECT24 software versions up to 2.19.4.
5
Can CVE-2026-33615 be exploited remotely?
Yes, CVE-2026-33615 can be exploited remotely by an unauthenticated attacker.