The TONNET E-LAN Hybrid Recording System contains an unauthenticated SQL injection vulnerability that permits remote attackers to extract sensitive database information.

This vulnerability is a classic SQL Injection flaw that does not require user authentication. It allows remote attackers to inject arbitrary SQL commands, granting them unauthorized read access to the system's database.

The ability for an unauthenticated attacker to remotely access database contents represents a critical failure in system security. Given the 7.5 CVSS score, this vulnerability facilitates the compromise of sensitive recordings, metadata, or user credentials, potentially leading to total system compromise and severe privacy violations.

Immediate Action: Apply vendor-provided security patches immediately upon availability to eliminate the SQL injection vector.

Proactive Monitoring: Review database access logs and query history for suspicious or unauthorized access patterns, especially those originating from external, non-trusted IP addresses.

Compensating Controls: Restrict management interface access to internal networks via VPN and utilize a WAF to filter incoming traffic for common SQL injection signatures.

Public Exploit Available: false

This vulnerability is particularly dangerous because it allows unauthenticated remote access. Organizations utilizing TONNET E-LAN systems must verify their exposure and implement network-level access controls immediately while awaiting specific vendor patches.