The vulnerability resides in an unknown function within the /DevicePrint.do?Action=ReadTask endpoint of Shenzhen Ruiming Technology Streamax Crocus, allowing an attacker to manipulate the State parameter and inject SQL statements. This remote SQL injection could enable unauthorized data disclosure or modification, compromising the confidentiality and integrity of the system’s database. The weakness aligns with common injection flaws identified by CWE-74 and CWE-89.

Shenzhen Ruiming Technology’s Streamax Crocus version 1.3.44 is affected. The issue is specific to the Parameter Handler component handling the /DevicePrint.do?Action=ReadTask request. No other versions or components are listed as vulnerable.

The CVSS score of 6.9 indicates a moderate severity level, but the exploit is public and can be launched remotely, which elevates the practical risk. EPSS data is unavailable and the vulnerability is not yet in the CISA KEV catalog. It is inferred from the description that the attack can be performed without authentication, relying solely on the vulnerable web endpoint exposed to the internet. Given the public nature of the exploit and the lack of vendor response, the likelihood of exploitation remains significant.