CVE-2026-33615Disclosure(mbconnectline / mbconnect24)

LOWCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

mbconnectline CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mbconnect24
mymbconnect24

Threat summary

Public PoC is present in monitored signal
5 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-04-02); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

mbconnectline

Products

mbconnect24mymbconnect24

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Disclosure

480.0%

General

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-02	4	Disclosure3General1
2026-04-03	1	Disclosure1

Full discourse5 posts

CosmicBytez@CosmicBytez189d
Disclosure
Security Advisory: CVE-2026-33615: Critical Unauthenticated SQL Injection in setinfo Endpoint https://labs.cosmicbytez.ca/security/cve-2026-33615 #Cybersecurity #InfoSec #CVE #PatchNow
Post summary
The advisory announces a critical unauthenticated SQL injection in the setinfo endpoint for CVE-2026-33615, providing essential technical details but lacking PoC, exploit code or patch information.
0000028
1 followersView on X
Galdino XS@galdinociber189d
Disclosure
CVE-2026-33615: SQL Injection crítico sem autenticação. CVSS 9.1. Endpoint afetado: /setinfo.
Post summary
The text discloses CVE-2026-33615, a critical unauthenticated SQL Injection affecting the /setinfo endpoint with a CVSS score of 9.1, without mentioning any PoC, exploit, or mitigation.
0000040
1 followersView on X
CVEFind.com@CveFindCom190d
General
[CVE-2026-33615: CRITICAL] Critical cyber security alert: Vulnerability in setinfo endpoint allows unauthenticated SQL Injection attack, leading to integrity and availability risks by remote attackers.#cve,CVE-2026-33615,#cybersecurity https://cvefind.com/CVE-2026-33615
Post summary
The tweet issues a critical alert for an unauthenticated SQL injection in the setinfo endpoint, but provides no PoC, exploit, patch, or evidence of active exploitation.
0000075
617 followersView on X
CVE@CVEnew190d
Disclosure
CVE-2026-33615 An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elemen… https://www.cve.org/CVERecord?id=CVE-2026-33615
Post summary
The text announces a newly disclosed unauthenticated SQL Injection vulnerability in the setinfo endpoint with no PoC, exploit tool, or mitigation references.
0000067
56.9K followersView on X
0day Signal@0dayPublishing190d
Disclosure
🚨 CVE-2026-33615: MB connect line mbCONNECT24 vuln... Raw SQL injection in industrial IoT gateway's setinfo endpoint - no auth required, UPDATE queries compromised, instant ... https://zerodaysignal.com/vulnerability/CVE-2026-33615 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A new CVE-2026-33615 is disclosed, detailing a raw SQL injection in an industrial IoT gateway’s setinfo endpoint that allows unauthenticated UPDATE queries, potentially enabling immediate compromise.
0000049
194 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mbconnectline	mbconnect24	-	-	-
App	mbconnectline	mymbconnect24	-	-	-

Explore more

Back to dashboard mbconnectline CVEs mbconnect24 vulnerabilities

What researchers are saying

CVE-2026-33615

CosmicBytez@CosmicBytezDisclosure

The advisory announces a critical unauthenticated SQL injection in the setinfo endpoint for CVE-2026-33615, providing essential technical details but lacking PoC, exploit code or patch information.

Galdino XS@galdinociberDisclosure

The text discloses CVE-2026-33615, a critical unauthenticated SQL Injection affecting the /setinfo endpoint with a CVSS score of 9.1, without mentioning any PoC, exploit, or mitigation.

CVEFind.com@CveFindComGeneral

The tweet issues a critical alert for an unauthenticated SQL injection in the setinfo endpoint, but provides no PoC, exploit, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

The text announces a newly disclosed unauthenticated SQL Injection vulnerability in the setinfo endpoint with no PoC, exploit tool, or mitigation references.

0day Signal@0dayPublishingDisclosure

A new CVE-2026-33615 is disclosed, detailing a raw SQL injection in an industrial IoT gateway’s setinfo endpoint that allows unauthenticated UPDATE queries, potentially enabling immediate compromise.