A critical SQL injection vulnerability in the Hotel Guest Hotspot product poses a severe risk of unauthorized database access and potential system compromise.

This vulnerability is a classic SQL injection (CWE-89) flaw where improper neutralization of input allows an attacker with low privileges (PR:L) to manipulate backend database queries. The vulnerability is accessible via the adjacent network (AV:A), meaning an attacker must have local network access to exploit the flaw.

The ability to perform unauthorized SQL queries can lead to the full compromise of sensitive guest or system data stored within the database. Given the CVSS score of 8.0, this is a high-severity issue that could result in total data loss, integrity compromise, or service disruption, requiring immediate attention to prevent unauthorized administrative actions.

Immediate Action: As the vendor has not provided a patch, administrators should restrict network access to the management interface of the affected devices and implement strict network segmentation to minimize exposure.

Proactive Monitoring: Monitor database access logs for unusual query patterns, such as unexpected UNION statements or attempts to access administrative tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to detect and block common SQL injection patterns targeting this device.

Public Exploit Available: No (exploit_available: false)

Due to the lack of a vendor-supplied patch, this vulnerability presents a persistent risk to environments utilizing the Hotel Guest Hotspot software. Organizations must prioritize isolating these devices from untrusted network segments and monitoring them for signs of unauthorized access until an official update is released or the product is decommissioned.