Mb Connect Line Mbconnect24 vulnerabilities

CVE-2026-40844 [MEDIUM] CWE-89 CVE-2026-40844: An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE-2021-34575 [HIGH] CWE-203 CVE-2021-34575: In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enume In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends.

CVE-2024-45273 [HIGH] CWE-261 CVE-2024-45273: An unauthenticated local attacker can decrypt the devices config file and therefore compromise the d An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.

CVE-2021-34580 [HIGH] CWE-204 CVE-2021-34580: In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

CVE-2020-12528 [HIGH] CWE-269 CVE-2020-12528: An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions th An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a logged in user to kill web2go sessions in the account he should not have access to.

CVE-2026-40829 [MEDIUM] CWE-89 CVE-2026-40829: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality a

CVE-2026-40828 [MEDIUM] CWE-89 CVE-2026-40828: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss

CVE-2026-40830 [MEDIUM] CWE-89 CVE-2026-40830: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentialit

CVE-2026-40827 [MEDIUM] CWE-89 CVE-2026-40827: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of

CVE-2026-40824 [MEDIUM] CWE-89 CVE-2026-40824: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and so

CVE-2026-40823 [MEDIUM] CWE-89 CVE-2026-40823: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of i

CVE-2026-40825 [MEDIUM] CWE-89 CVE-2026-40825: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and s

CVE-2026-33617 [MEDIUM] CWE-497 CVE-2026-33617: An unauthenticated remote attacker can access a configuration file containing database credentials. An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.

CVE-2026-40826 [MEDIUM] CWE-89 CVE-2026-40826: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE-2026-40821 [MEDIUM] CWE-89 CVE-2026-40821: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE-2026-40822 [MEDIUM] CWE-89 CVE-2026-40822: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE-2020-12527 [MEDIUM] CWE-269 CVE-2020-12527: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corresponding permissions.

CVE-2024-23942 [HIGH] CWE-312 CVE-2024-23942: A local user may find a configuration file on the client workstation with unencrypted sensitive data A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.

CVE-2022-22520 [MEDIUM] CWE-204 CVE-2022-22520: A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the web A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

CVE-2020-12529 [MEDIUM] CWE-918 CVE-2020-12529: An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions th An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allowing an attacker to scan for open ports.