CVE-2024-6699 is a critical severity (CVSS 9.8) SQL injection in Mikafon MA7, an product of Mikafon Electronic Inc., affecting versions from v3.0 before v3.1. The record shows no login is needed. Update to v3.1 or later and keep the device off networks you do not control.
What's affected
The record says the issue affects Mikafon MA7 from v3.0 before v3.1. The CPE entries describe it as firmware on a hardware device. That means the fix is a firmware update and not a library bump.
The record points to two Turkish national advisories (USOM and the Cyber Security Presidency). The page I could fetch showed only a site header, so I could not read the advisory text. Confirm the exact fixed build with the vendor or the advisory, and take v3.1 from the record as the minimum.
How to check if you're exposed
Open the device administration page or its about screen and read the firmware version. A value of 3.0 up to but not including 3.1 is affected. If you cannot read the version, ask the vendor or the integrator who installed it.
Then ask a network question: who can reach the device's web or API interface? From a normal user network, try to connect to the management address. If it answers, so can anyone else with that route. Also search your asset list for MA7 devices that were never inventoried, since small hardware is often missed.
What to do now
- Find every Mikafon MA7 device and note its firmware version.
- Obtain firmware v3.1 or later from Mikafon and apply it in a maintenance window.
- Until then, restrict access to the management interface to a small admin network or a VPN.
- Review device logs and any connected database for unexpected activity.
- Add the device to your regular inventory and patch review so the next advisory is not missed.
Why it matters
The weakness is CWE-89, SQL injection. The device builds a database query from input without neutralising special characters, so input can change the meaning of the query. The vector is network reachable, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. That combination is how a flaw reaches 9.8.
Embedded and appliance products are hard to patch because they have no package manager and often no owner. The record does not list the CVE as known exploited, and I found no statement of exploitation. That does not make it safe to wait. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for checking the packages your own projects pull in. It will not scan firmware, but it helps for the software around it.
Quick check
Is this a software library flaw?
No. The record lists Mikafon MA7 firmware and hardware, so the fix is a vendor firmware update.
Is it exploited in the wild?
The record does not flag it as known exploited, and I found no advisory text saying so.
Sources
Last reviewed: 19 October 2026.
