## Summary
An unauthenticated attacker can exploit an SQL Injection in the getLiveValues function via the sn parameter. The issue is reachable over the network and can lead to a total loss of confidentiality.
## Technical Details
- Vulnerability type: SQL Injection (CWE-89)
- Affected code path: getLiveValues function
- Injection point: sn parameter in a SQL SELECT command
- Root cause (as described): improper neutralization of special elements in the SQL query
- Attack prerequisites: none beyond network reachability (CVSS indicates PR:N and UI:N)
- Likely behavior: attacker-controlled input in sn is incorporated into a SQL SELECT, enabling unauthorized data retrieval
## Affected
- Vendor: MB connect line GmbH
- Product family: mbCONNECT24 / mymbCONNECT24
- Advisory reference: VDE-2026-044 (CERT-VDE)
## Impact
- Confidentiality: High / total loss of confidentiality (per NVD description)
- Integrity: no impact indicated in the provided NVD metrics (I:N)
- Availability: no impact indicated in the provided NVD metrics (A:N)
- Scope: unchanged (S:U)
## Mitigation
1. Apply the vendor’s security update(s) for mbCONNECT24 / mymbCONNECT24 referenced by CERT-VDE advisory VDE-2026-044.
2. If patching is not immediately possible, restrict network access to the affected service so only trusted clients can reach it.
3. Add/verify server-side input validation and parameterized queries for the getLiveValues handling of the sn parameter.
4. Monitor for anomalous requests targeting the getLiveValues endpoint with unexpected sn values (e.g., patterns consistent with SQLi payloads).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-89