mbconnectline 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk open redirect、パス処理の欠陥, and vendor risk file inclusion に関連することが多く、vendor surface software deployment and vendor surface production workloads の文脈で vendor impact unauthorized access and vendor impact memory corruption などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-33617 | An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials. | [email protected] | 5.3 | 0.27% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33616 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. | [email protected] | 7.5 | 0.34% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33615 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability. | [email protected] | 9.1 | 0.41% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33614 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. | [email protected] | 7.5 | 0.34% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33613 | Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table. | [email protected] | 7.2 | 0.50% | 2026-04-02 | 2026-04-16 |
| CVE-2025-41681 | A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. | [email protected] | 4.8 | 0.27% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41679 | An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service. | [email protected] | 5.3 | 0.61% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41678 | A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement. | [email protected] | 6.5 | 0.56% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41677 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession. | [email protected] | 4.9 | 0.52% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41676 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. | [email protected] | 4.9 | 0.50% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41675 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command. | [email protected] | 7.2 | 0.57% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41674 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command. | [email protected] | 7.2 | 0.57% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41673 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command. | [email protected] | 7.2 | 0.57% | 2025-07-21 | 2025-11-06 |
| CVE-2024-45276 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. | [email protected] | 7.5 | 0.62% | 2024-10-15 | 2025-01-24 |
| CVE-2024-45275 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices. | [email protected] | 9.8 | 0.80% | 2024-10-15 | 2024-11-21 |
| CVE-2024-45274 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. | [email protected] | 9.8 | 1.54% | 2024-10-15 | 2025-11-03 |
| CVE-2024-45273 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | [email protected] | 8.4 | 0.07% | 2024-10-15 | 2024-11-21 |
| CVE-2024-45272 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | [email protected] | 7.5 | 0.60% | 2024-10-15 | 2024-11-21 |
| CVE-2024-45271 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. | [email protected] | 8.4 | 0.31% | 2024-10-15 | 2025-08-26 |
| CVE-2023-4834 | In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to. | [email protected] | 4.3 | 0.33% | 2023-10-16 | 2024-11-21 |