Advisories · Technology

MB connect line mbCONNECT24.

Every CVE that names MB connect line mbCONNECT24 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-14448 CVE record

CVSS 8.6 High

Authenticated RCE in system_certificates view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Command injection
Not analysed yet 20 Jul 2026
CVE-2026-10521 CVE record

CVSS 8.6 High

Authenticated unintended access to critical program parameters
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Broken access control
Not analysed yet 23 Jun 2026
CVE-2026-40850 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getAccountData function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40849 CVE record

CVSS 7.1 High

Authenticated SQLi in user_alarmprofile view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40848 CVE record

CVSS 7.1 High

Authenticated SQLi in tag view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40847 CVE record

CVSS 7.1 High

Authenticated SQLi in system_tag view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40846 CVE record

CVSS 7.1 High

Authenticated SQLi in system view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40845 CVE record

CVSS 7.1 High

Authenticated SQLi in devices_configuration view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40844 CVE record

CVSS 7.1 High

Authenticated SQLi in dashboard view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40843 CVE record

CVSS 7.1 High

Authenticated SQLi in alarming view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40842 CVE record

CVSS 7.1 High

Authenticated SQLi in getWidgetTags function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40841 CVE record

CVSS 7.1 High

Authenticated SQLi in getProjectTags function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40840 CVE record

CVSS 7.1 High

Authenticated SQLi in VerifyCreateLicences function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40839 CVE record

CVSS 7.1 High

Authenticated SQLi in getComponentScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40838 CVE record

CVSS 7.1 High

Authenticated SQLi in getDeviceScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40837 CVE record

CVSS 7.1 High

Authenticated SQLi in getProjectScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40836 CVE record

CVSS 7.1 High

Authenticated SQLi in inmessage model
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40835 CVE record

CVSS 7.1 High

Authenticated SQLi in saveObjectFromData function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40834 CVE record

CVSS 7.1 High

Authenticated SQLi in saveDashboardLayout function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40833 CVE record

CVSS 7.1 High

Authenticated SQLi in saveDashboardLayout function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40832 CVE record

CVSS 7.1 High

Authenticated SQLi in getDevicegroups function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40831 CVE record

CVSS 7.1 High

Authenticated SQLi in Easy View
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40830 CVE record

CVSS 7.0 High

Authenticated SQLi in UpdateParam function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40829 CVE record

CVSS 7.0 High

Authenticated SQLi in UpdateParam function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40828 CVE record

CVSS 7.0 High

Authenticated SQLi in DeleteSysLogEntry function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40827 CVE record

CVSS 7.0 High

Authenticated SQLi in _RemoveRequest function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40826 CVE record

CVSS 6.9 Medium

Authenticated SQLi in dsgvo_contracts view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40825 CVE record

CVSS 7.0 High

Authenticated SQLi in accountstatus view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40824 CVE record

CVSS 7.0 High

Authenticated SQLi in accountstatus view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40823 CVE record

CVSS 7.0 High

Authenticated SQLi in DevSerialReset function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40822 CVE record

CVSS 6.9 Medium

Authenticated SQLi in DevSerialReset function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40821 CVE record

CVSS 6.9 Medium

Authenticated SQLi in getAccountByID function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40819 CVE record

CVSS 8.7 High

Unauthenticated SQLi in sync_data24 task
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40818 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24confi_getDevice function function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40817 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getAlarmProfiles function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40816 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24confi_getTagAlarm function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40815 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24api_getUserAccount function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40814 CVE record

CVSS 8.7 High

Unauthenticated SQLi in _mb24confi_getTagAlarm function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40813 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getLiveValues
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40812 CVE record

CVSS 8.7 High

Unauthenticated SQLi in getLiveValues function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40811 CVE record

CVSS 8.7 High

Unauthenticated SQLi in ssoabstractservice
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-40810 CVE record

CVSS 8.7 High

Unauthenticated SQLi in userinfo Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 27 May 2026
CVE-2026-33617 CVE record

CVSS 5.3 Medium

MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Information disclosure
Not analysed yet 2 Apr 2026
CVE-2026-33616 CVE record

CVSS 7.5 High

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-33615 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-33614 CVE record

CVSS 7.5 High

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-33613 CVE record

CVSS 7.2 High

MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Command injection
Not analysed yet 2 Apr 2026
CVE-2026-32969 CVE record

CVSS 7.5 High

Pre-Auth Blind SQLi in userinfo Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 23 Mar 2026
CVE-2026-32968 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unauthenticated RCE in com_mb24sysapi
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Command injection
Not analysed yet 23 Mar 2026
CVE-2025-3092 CVE record

CVSS 7.5 High

MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24
- Helmholz myREX24
- Helmholz myREX24.virtual
- CWE-204
Not analysed yet 24 Jun 2025
CVE-2025-3091 CVE record

CVSS 7.5 High

MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Broken access control
Not analysed yet 24 Jun 2025
CVE-2025-3090 CVE record

CVSS 8.2 High

MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Authentication bypass
Not analysed yet 24 Jun 2025
CVE-2024-23943 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

MB connect line: Cloud API access due to a lack of authentication for a critical function
- MB connect line mbCONNECT24
- MB connect line mbNET
- Authentication bypass
Not analysed yet 18 Mar 2025
CVE-2024-23942 CVE record

CVSS 7.1 High

MB connect line: Configuration File on the client workstation is not encrypted
- MB connect line mbCONNECT24
- MB connect line mbNET
- Information disclosure
Not analysed yet 18 Mar 2025
CVE-2024-45273 CVE record

CVSS 8.4 High

MB connect line/Helmholz: Weak encryption of configuration file
- MB connect line mbNET.mini
- MB connect line mbNET/mbNET.rokey
- CWE-261
Not analysed yet 15 Oct 2024
CVE-2024-45272 CVE record

CVSS 7.5 High

MB connect line/Helmholz: Generation of weak passwords vulnerability
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Hard-coded credentials
Not analysed yet 15 Oct 2024
CVE-2023-1779 CVE record

CVSS 4.3 Medium

Helmholz and MB Connect Line: Account takeover via password reset in multiple products
- MB Connect Line mbCONNECT24
- MB Connect Line mymbCONNECT24
- Broken access control
Not analysed yet 6 Jun 2023
CVE-2023-0985 CVE record

CVSS 8.8 High

Helmholz and MB Connect Line: Account takeover via password reset in multiple products
- MB Connect Line mbCONNECT24
- MB Connect Line mymbCONNECT24
- Broken access control
Not analysed yet 6 Jun 2023
CVE-2022-22520 CVE record

CVSS 5.3 Medium

User enumeration vulnerability in MB connect line and Helmholz products
- MB connect line mymbCONNECT24
- MB connect line mbCONNECT24
- CWE-204
Not analysed yet 14 Sept 2022
CVE-2021-34580 CVE record

CVSS 7.5 High

Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0
- MB connect line mymbCONNECT24
- MB connect line mbCONNECT24
- CWE-204
Not analysed yet 27 Oct 2021