The vulnerability is a classic SQL injection flaw that allows an unauthenticated remote attacker to inject arbitrary SQL commands and read data stored in the device’s internal database. This flaw is identified as CWE‑89 and grants direct access to confidential information without requiring any prior credentials.

The affected system is the TONNET E‑LAN Hybrid Recording System, model TPR7308. Firmware versions prior to mdiskTRS08_tonnet_20260203-1636 contain the flaw.

The CVSS base score of 8.7 classifies this as high severity. Because the EPSS score is not available and it is not listed in the CISA KEV catalog, the current chance of exploitation is unclear, but the flaw can be exploited remotely through unauthenticated requests, likely targeting the system’s web interface or API endpoints. Attacks would leverage the ability to read database contents to exfiltrate sensitive data.