{"id":"CVE-2026-40820","kind":"vulnerability","aliases":["CVE-2026-40820"],"related":[],"title":"VPN gateway getVpnData function allows SQL injection, exposing all stored data","description":"A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.","summary":"An unauthenticated remote attacker with high privileges can inject SQL through the getVpnData function, because special characters in a SELECT command are not neutralized. The sources say a successful attack can cause a total loss of confidentiality.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","sql-injection","vpn"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:15+00:00","triaged_at":"2026-11-12T08:38:33+00:00","updated_at":"2026-11-12T08:38:33+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-11-12T08:38:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VPN gateway getVpnData function allows SQL injection, exposing all stored data","impact":"high","summary":"An unauthenticated remote attacker with high privileges can inject SQL through the getVpnData function, because special characters in a SELECT command are not neutralized. The sources say a successful attack can cause a total loss of confidentiality.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["vpn","sql-injection"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads all confidential data stored behind the VPN function","analyst_note":"Identify the vendor and product behind getVpnData from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-40820 and find its affected versions and fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the product or versions affected. The flaw is in a VPN-related function that reads data through a SQL SELECT command, so any team running a VPN appliance or gateway from the affected vendor should check whether it is exposed. Teams not running that product can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4534,"output_tokens":473,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-40820':14A,17A 'allow':5A 'attack':26B,52B,64C 'caus':54B 'charact':39B 'command':43B,87C 'confidenti':59B,96C 'cve':12A,15A 'data':11A 'due':76C 'element':82C 'exploit':66C 'expos':8A 'function':4A,36B,75C 'gateway':2A 'getvpndata':3A,35B,74C 'high':28B,61C 'improp':78C 'infrastructur':18B 'inject':7A,21B,31B,70C 'loss':57B,94C 'neutral':46B,79C 'privileg':29B,62C 'remot':25B,63C 'result':90C 'say':49B 'select':42B,86C 'sourc':48B 'special':38B,81C 'sql':6A,20B,32B,69C,85C 'sql-inject':19B 'store':10A 'success':51B 'total':56B,93C 'unauthent':24B,68C 'vpn':1A,22B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the product or versions affected. The flaw is in a VPN-related function that reads data through a SQL SELECT command, so any team running a VPN appliance or gateway from the affected vendor should check whether it is exposed. Teams not running that product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","sqlinjection","vpn"],"campaign_type":null,"search_a":"'-2026':13A,16A '-40820':14A,17A 'allow':5A 'cve':12A,15A 'data':11A 'expos':8A 'function':4A 'gateway':2A 'getvpndata':3A 'inject':7A 'sql':6A 'store':10A 'vpn':1A","search_b":"'attack':26B,52B 'caus':54B 'charact':39B 'command':43B 'confidenti':59B 'function':36B 'getvpndata':35B 'high':28B 'infrastructur':18B 'inject':21B,31B 'loss':57B 'neutral':46B 'privileg':29B 'remot':25B 'say':49B 'select':42B 'sourc':48B 'special':38B 'sql':20B,32B 'sql-inject':19B 'success':51B 'total':56B 'unauthent':24B 'vpn':22B","search_c":"'attack':64C 'command':87C 'confidenti':96C 'due':76C 'element':82C 'exploit':66C 'function':75C 'getvpndata':74C 'high':61C 'improp':78C 'inject':70C 'loss':94C 'neutral':79C 'privileg':62C 'remot':63C 'result':90C 'select':86C 'special':81C 'sql':69C,85C 'total':93C 'unauthent':68C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:16:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40820","severity":null,"published_at":"2026-11-12T08:16:41+00:00","modified_at":"2026-11-12T08:16:41+00:00","first_seen_at":"2026-11-12T08:37:15+00:00","fetched_at":"2026-11-12T08:37:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}