An unauthenticated remote attacker can read a configuration file that contains database credentials, resulting in a partial loss of confidentiality. The attack does not grant use of the credentials, but exposure of those secrets can still lead to data privacy concerns. The weakness is identified as CWE-497 (Insecure Interface Design).

The vulnerability impacts MB connect line products: mbCONNECT24 and mymbCONNECT24. No specific version range is documented, so the issue should be considered to affect all current and older releases of these products until a patch is issued.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack vector is inferred to be remote and unauthenticated, leveraging the data24 Endpoint exposed by the affected application. The lack of a known exploit path and the moderate CVSS score imply that while the risk is present, immediate widespread exploitation is unlikely, but remediation is still recommended.