MB connect line: Authenticated unintended access to critical program parameters in mbCONNECT24/mymbCONNECT24
view advisory published 2026-06-23
There is a vulnerability in mbCONNECT24/mymbCONNECT24 that allows an authenticated remote attacker to access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-10521US | — | — | ||
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a… | ||||
02
references
External citations — patches, advisories, analysis.
- Security Incident Management SIM#2026-04 - PDFself
- VDE-2026-068: MB connect line: Authenticated unintended access to critical program parameters in mbCONNECT24/mymbCONNECT24 - HTMLself
- CERT@VDE Security Advisories for MB connect lineexternal
- Product security incident reportsexternal
- VDE-2026-068: MB connect line: Authenticated unintended access to critical program parameters in mbCONNECT24/mymbCONNECT24 - CSAFself
03
remediations (1)
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.2.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan