Aggregates CVE and security vulnerability intelligence across all mbconnectline-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Disclosed issues often relate to vendor risk open redirect, vendor risk path handling, and vendor risk file inclusion; exposure may include vendor impact unauthorized access in vendor surface software deployment contexts.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-33617 | An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials. | [email protected] | 5.3 | 0.03% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33616 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. | [email protected] | 7.5 | 0.05% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33615 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability. | [email protected] | 9.1 | 0.04% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33614 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. | [email protected] | 7.5 | 0.05% | 2026-04-02 | 2026-04-16 |
| CVE-2026-33613 | Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table. | [email protected] | 7.2 | 0.13% | 2026-04-02 | 2026-04-16 |
| CVE-2025-41681 | A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. | [email protected] | 4.8 | 0.15% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41679 | An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service. | [email protected] | 5.3 | 0.53% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41678 | A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement. | [email protected] | 6.5 | 0.67% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41677 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession. | [email protected] | 4.9 | 0.66% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41676 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. | [email protected] | 4.9 | 0.66% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41675 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command. | [email protected] | 7.2 | 0.67% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41674 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command. | [email protected] | 7.2 | 0.67% | 2025-07-21 | 2025-11-06 |
| CVE-2025-41673 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command. | [email protected] | 7.2 | 0.67% | 2025-07-21 | 2025-11-06 |
| CVE-2024-45276 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. | [email protected] | 7.5 | 0.49% | 2024-10-15 | 2025-01-24 |
| CVE-2024-45275 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices. | [email protected] | 9.8 | 3.43% | 2024-10-15 | 2024-11-21 |
| CVE-2024-45274 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. | [email protected] | 9.8 | 3.60% | 2024-10-15 | 2025-11-03 |
| CVE-2024-45273 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | [email protected] | 8.4 | 0.07% | 2024-10-15 | 2024-11-21 |
| CVE-2024-45272 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | [email protected] | 7.5 | 1.02% | 2024-10-15 | 2024-11-21 |
| CVE-2024-45271 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. | [email protected] | 8.4 | 0.12% | 2024-10-15 | 2025-08-26 |
| CVE-2023-4834 | In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to. | [email protected] | 4.3 | 0.11% | 2023-10-16 | 2024-11-21 |