CVE-2026-40822

MediumCVSS 4.9

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A SQL Injection vulnerability in the DevSerialReset function arises from improper neutralization of special elements in a SQL SELECT command. A high privileged remote attacker can read the entire database.

Risk Assessment

This can result in a total loss of confidentiality. An attacker could access sensitive information stored in the database.

Recommendation

Apply the vendor-provided patch as soon as possible. Additionally, use parameterized queries and restrict access to administrative functions.

Other vulnerabilities in DevSerialReset

CVE-2026-40823Medium
An SQL Injection vulnerability in the DevSerialReset function is caused by improper neutralization of special elements in a SQL UPDATE command. A high privileged remote attacker can read the whole database and change values in a non critical table.

Original NVD description (English source)

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS