MB connect line: Multiple SQLi vulnerabilities in mbCONNECT24/mymbCONNECT24
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24.
describes (42)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-14448US | — | — | ||
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special element… | ||||
| CVE-2026-40850US | — | — | ||
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a… | ||||
| CVE-2026-40849US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a S… | ||||
| CVE-2026-40848US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT comm… | ||||
| CVE-2026-40847US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELE… | ||||
| CVE-2026-40846US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT c… | ||||
| CVE-2026-40845US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in… | ||||
| CVE-2026-40844US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELEC… | ||||
| CVE-2026-40843US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT… | ||||
| CVE-2026-40842US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a S… | ||||
| CVE-2026-40841US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a… | ||||
| CVE-2026-40840US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements… | ||||
| CVE-2026-40839US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements… | ||||
| CVE-2026-40838US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in… | ||||
| CVE-2026-40837US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements i… | ||||
| CVE-2026-40836US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELE… | ||||
| CVE-2026-40835US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements i… | ||||
| CVE-2026-40834US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralizatio… | ||||
| CVE-2026-40833US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of sp… | ||||
| CVE-2026-40832US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a… | ||||
references
External citations — patches, advisories, analysis.
- Security Incident Management SIM#2026-01-1 - PDFself
- VDE-2026-044: MB connect line: Multiple SQLi vulnerabilities in mbCONNECT24/mymbCONNECT24 - HTMLself
- CERT@VDE Security Advisories for MB connect lineexternal
- Product security incident reportsexternal
- VDE-2026-044: MB connect line: Multiple SQLi vulnerabilities in mbCONNECT24/mymbCONNECT24 - CSAFself
remediations (43)
- Mitigation
This function is not enabled by default and can only be enabled if an attacker already has a root shell on the system. This function is only enabled on MBCL hosted instances behind the Gatekeeper service. On these instances access to this function is restricted by an IP whitelist on the LAN interface.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
- Fixed
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan