CVE-2026-40823

MediumCVSS 5.5

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

An SQL Injection vulnerability in the DevSerialReset function is caused by improper neutralization of special elements in a SQL UPDATE command. A high privileged remote attacker can read the whole database and change values in a non critical table.

Risk Assessment

Exploitation can result in a total loss of confidentiality and some loss of integrity of data.

Recommendation

Update the software to a patched version and enforce parameterized SQL queries and input validation.

Other vulnerabilities in DevSerialReset

CVE-2026-40822Medium
A SQL Injection vulnerability in the DevSerialReset function arises from improper neutralization of special elements in a SQL SELECT command. A high privileged remote attacker can read the entire database.

Original NVD description (English source)

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS