What is the CVSS score of CVE-2026-33613?

CVE-2026-33613 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-33613?

Within 24 hours: Inventory all mbCONNECT24 and mymbCONNECT24 deployments and document current versions. Restrict network access to these systems using firewall rules, limiting connections to trusted administrative sources only. Within 7 days: Review access logs for any suspicious database write activity or authentication anomalies targeting user table modifications; isolate any compromised instances. Implement enhanced monitoring for command execution within the application environment. Within 30 days: Establish a vendor contact channel with MB Connect Line to obtain patch status and release timeline; prepare a deployment plan for immediate application once patches become available. Consider evaluating alternative connectivity solutions if patch availability remains uncertain.

Mbconnect24 CVE-2026-33613

EUVD-2026-18173 HIGH

OS Command Injection (CWE-78)

2026-04-02 CERTVDE

GHSA-jmc2-v37m-hrwj

Command Injection Mbconnect24 Mymbconnect24

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 15:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 02, 2026 - 09:30 euvd

EUVD-2026-18173

Analysis Generated

Apr 02, 2026 - 09:30 vuln.today

CVE Published

Apr 02, 2026 - 08:59 nvd

HIGH 7.2

DescriptionCVE.org

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

AnalysisAI

Remote code execution in MB Connect Line mbCONNECT24 and mymbCONNECT24 allows high-privileged authenticated attackers to achieve full system compromise through command injection in the generateSrpArray function. Exploitation requires the attacker to first write arbitrary data to the user table via another vulnerability, establishing a chained attack scenario. No public exploit identified at time of analysis, though the low attack complexity (AC:L) indicates straightforward exploitation once database write access is obtained.

Technical ContextAI

This vulnerability stems from CWE-78 (OS Command Injection), where the generateSrpArray function fails to properly sanitize special elements before passing them to operating system commands. The affected products are MB Connect Line mbCONNECT24 (cpe:2.3:a:mb_connect_line:mbconnect24) and mymbCONNECT24 (cpe:2.3:a:mb_connect_line:mymbconnect24), which are industrial IoT gateway management platforms used for secure remote access to industrial equipment. The command injection occurs when user-controlled data from the database is processed without adequate neutralization of shell metacharacters, allowing arbitrary command execution within the context of the application process. This represents a second-order injection vulnerability, as malicious payloads must first be stored in the user table before being triggered through the SRP (Secure Remote Password) array generation routine.

RemediationAI

Organizations should immediately consult the MB Connect Line vendor advisories available at https://certvde.com/de/advisories/VDE-2026-030 and the CSAF security document at https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json for specific patching instructions and affected version identification. Patch availability per vendor advisory should be verified directly through these channels, as exact fixed versions are not specified in the current CVE data. As interim mitigation, organizations should restrict administrative access to mbCONNECT24 and mymbCONNECT24 management interfaces to trusted networks only, implement strong authentication controls for high-privilege accounts, monitor user table modifications for suspicious activity, and audit existing database entries for potential malicious payloads. Network segmentation should isolate these industrial IoT gateway platforms from untrusted networks, and access logging should be enabled to detect potential exploitation chains involving database manipulation followed by SRP array generation operations.