Advisories · Technology

Helmholz myREX24V2.virtual.

Every CVE that names Helmholz myREX24V2.virtual among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-14448 CVE record

CVSS 8.6 High

Authenticated RCE in system_certificates view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Command injection
Not analysed yet 20 Jul 2026
CVE-2026-40850 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getAccountData function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40849 CVE record

CVSS 7.1 High

Authenticated SQLi in user_alarmprofile view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40848 CVE record

CVSS 7.1 High

Authenticated SQLi in tag view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40847 CVE record

CVSS 7.1 High

Authenticated SQLi in system_tag view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40846 CVE record

CVSS 7.1 High

Authenticated SQLi in system view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40845 CVE record

CVSS 7.1 High

Authenticated SQLi in devices_configuration view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40844 CVE record

CVSS 7.1 High

Authenticated SQLi in dashboard view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40843 CVE record

CVSS 7.1 High

Authenticated SQLi in alarming view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40842 CVE record

CVSS 7.1 High

Authenticated SQLi in getWidgetTags function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40841 CVE record

CVSS 7.1 High

Authenticated SQLi in getProjectTags function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40840 CVE record

CVSS 7.1 High

Authenticated SQLi in VerifyCreateLicences function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40839 CVE record

CVSS 7.1 High

Authenticated SQLi in getComponentScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40838 CVE record

CVSS 7.1 High

Authenticated SQLi in getDeviceScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40837 CVE record

CVSS 7.1 High

Authenticated SQLi in getProjectScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40836 CVE record

CVSS 7.1 High

Authenticated SQLi in inmessage model
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40835 CVE record

CVSS 7.1 High

Authenticated SQLi in saveObjectFromData function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40834 CVE record

CVSS 7.1 High

Authenticated SQLi in saveDashboardLayout function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40833 CVE record

CVSS 7.1 High

Authenticated SQLi in saveDashboardLayout function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40832 CVE record

CVSS 7.1 High

Authenticated SQLi in getDevicegroups function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40831 CVE record

CVSS 7.1 High

Authenticated SQLi in Easy View
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40830 CVE record

CVSS 7.0 High

Authenticated SQLi in UpdateParam function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40829 CVE record

CVSS 7.0 High

Authenticated SQLi in UpdateParam function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40828 CVE record

CVSS 7.0 High

Authenticated SQLi in DeleteSysLogEntry function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40827 CVE record

CVSS 7.0 High

Authenticated SQLi in _RemoveRequest function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40826 CVE record

CVSS 6.9 Medium

Authenticated SQLi in dsgvo_contracts view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40825 CVE record

CVSS 7.0 High

Authenticated SQLi in accountstatus view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40824 CVE record

CVSS 7.0 High

Authenticated SQLi in accountstatus view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40823 CVE record

CVSS 7.0 High

Authenticated SQLi in DevSerialReset function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40822 CVE record

CVSS 6.9 Medium

Authenticated SQLi in DevSerialReset function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40821 CVE record

CVSS 6.9 Medium

Authenticated SQLi in getAccountByID function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40819 CVE record

CVSS 8.7 High

Unauthenticated SQLi in sync_data24 task
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40818 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24confi_getDevice function function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40817 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getAlarmProfiles function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40816 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24confi_getTagAlarm function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40815 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24api_getUserAccount function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40814 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24confi_getTagAlarm function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40813 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getLiveValues
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40812 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getLiveValues function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40811 CVE record

CVSS 8.7 High

Unauthenticated SQLi in ssoabstractservice
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40810 CVE record

CVSS 8.7 High

Unauthenticated SQLi in userinfo Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-32969 CVE record

CVSS 7.5 High

Pre-Auth Blind SQLi in userinfo Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 23 Mar 2026
CVE-2026-32968 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unauthenticated RCE in com_mb24sysapi
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Command injection
Not analysed yet 23 Mar 2026