CVE-2026-33614
Published: 02 April 2026
Summary
CVE-2026-33614 is a high-severity SQL Injection (CWE-89) vulnerability in Mbconnectline Mbconnect24. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33614 is an unauthenticated SQL injection vulnerability (CWE-89) in the getinfo endpoint, stemming from improper neutralization of special elements used in a SQL SELECT command. Published on 2026-04-02, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity primarily due to its impact on confidentiality.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation enables a total loss of confidentiality, potentially allowing the attacker to extract sensitive data from the underlying database.
Advisories detailing mitigations and patches are available from CERT VDE under VDE-2026-030, accessible at https://certvde.com/de/advisories/VDE-2026-030 and as a CSAF document at https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18174
Vulnerability details
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing getinfo endpoint directly enables remote exploitation of public-facing applications (T1190) for unauthorized database data extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of special elements in inputs to the getinfo endpoint SQL SELECT command, preventing SQL injection exploitation.
Provides for timely identification, reporting, and remediation of the specific SQL injection flaw via patching as detailed in related advisories.
Boundary protection at external interfaces can deploy web application firewalls to inspect traffic and block SQL injection patterns targeting the unauthenticated getinfo endpoint.