The flaw originates in the /RemoteFormat.do endpoint of Streamax Crocus bis 1.3.44. An attacker can manipulate the State parameter so that untrusted input is concatenated into an SQL query, allowing execution of arbitrary statements. This injection can reveal, alter, or delete data in the backend database depending on its privileges, representing a threat to confidentiality, integrity, and possibly availability. The weakness aligns with input validation and SQL injection categories.

The only version explicitly identified as vulnerable is Shenzhen Ruiming Technology’s Streamax Crocus bis 1.3.44. No other product revisions are currently listed.

The CVSS v3.1 base score of 6.9 indicates a medium severity vulnerability. The description confirms that the attack can be performed remotely, likely without the need for local authentication, and the public disclosure suggests that exploitation is possible. While the Exploit Prediction Scoring System score is not available and the issue is not in the CISA Known Exploited Vulnerabilities list, the presence of public exploits indicates that the flaw may already be abused in the wild. Given these factors, the overall risk is significant, and timely remediation is advised.