External risk intelligence

SQL Injection in mbconnect24 and mymbconnect24 setinfo Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-33615

The product, mbconnect24, is an industrial remote access and VPN management platform. Such gateways are designed to be internet-facing to provide secure remote connectivity to industrial networks. Because the vulnerability exists in an unauthenticated endpoint, it is directly exposed to public-internet-facing access as part of its standard role as a remote service gateway.

SQL Injection

Mbconnectline Mbconnect24

2.19.4 and earlier

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated remote attacker can exploit a SQL injection vulnerability in the setinfo endpoint of mbconnect24 and mymbconnect24, which are remote access and VPN management platforms. This vulnerability could lead to a loss of data integrity and availability for the affected systems. The main concern is confirming relevance and exposure to these systems.

Attacker can alter or delete data remotely.
Critical systems are targeted by this vulnerability.
Confirm exposure and relevance to business operations.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could reach the `setinfo` endpoint over the network to send a specially crafted SQL UPDATE command. This command would bypass security checks due to improper handling of special characters, allowing the attacker to manipulate or delete data.

No authentication required to attack.
Vulnerable `setinfo` endpoint targeted.
Data integrity and availability lost.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity and availability of the `mbconnect24` and `mymbconnect24` services. When exploited, an attacker could manipulate data or disrupt service operations, impacting the normal functioning of these systems under supported conditions.

Data integrity and service availability.
Remote, unauthenticated SQL injection attack.
Total loss of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability impacts the setinfo endpoint of mbconnect24 and mymbconnect24 products. Owners of these industrial remote access and VPN management platforms, likely platform or infrastructure teams, should prioritize identifying all instances, assessing their network exposure, and confirming business criticality. Vendor coordination will be crucial for remediation planning.

Platform owners should manage this issue.
Verify public network exposure and criticality.
Plan remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mbconnect24?

mbconnect24 and mymbconnect24 are industrial platforms used for remote access and VPN management. They function as gateways, enabling secure, authorized connectivity between remote users and industrial control networks. By providing this bridge, these tools allow administrators to monitor and manage equipment from outside the local network environment.

What does SQL injection mean for CVE-2026-33615?

This vulnerability, classified as CWE-89, occurs when an application fails to properly filter special characters in user-supplied data before including them in database commands. In this specific case, the flaw allows an unauthenticated attacker to inject malicious code into the 'setinfo' endpoint, which then executes as a SQL UPDATE command, potentially enabling unauthorized data modification or deletion.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted request directly to the 'setinfo' network endpoint. Because the endpoint does not require prior authentication, the attacker does not need legitimate credentials to execute the malicious SQL command. The issue is specifically tied to this endpoint; it is not triggered by normal, authorized administrative interactions with the platform.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies that because mbconnect24 serves as a remote access and VPN gateway, it is frequently deployed in internet-facing configurations to facilitate connectivity. Since the vulnerable 'setinfo' endpoint is reachable over the network without authentication, any instance directly exposed to the public internet faces a significantly higher risk of unauthorized access.

What should I do if I run this software?

Start by identifying all instances of mbconnect24 or mymbconnect24 within your infrastructure to assess their specific network exposure and business criticality. Prioritize checking if these gateways are reachable from the internet. Coordinate with your vendor to obtain official guidance or updates, and plan your remediation steps based on the necessity of maintaining secure remote access for your operations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.