CVE-2026-2397
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An SQL injection vulnerability (CWE-89) has been found in MobilMen 20T by Adam Retail Automation Ltd. The flaw allows an attacker to manipulate database queries due to improper neutralization of special elements in SQL commands.
Risk Assessment
An attacker can gain unauthorized access, modify, or delete data, compromising system confidentiality and integrity. The risk is elevated because the vendor did not respond to the disclosure and no patch is available.
Recommendation
Immediately disconnect the system from the network or apply temporary WAF rules to block malicious SQL queries. Since the vendor did not respond, consider replacing the software with an alternative solution.
Original NVD description (English source)
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.