Which versions of mbCONNECT24 are affected by CVE-2026-40810?

Red Lion's remote-maintenance platform (mbCONNECT24, mymbCONNECT24, myREX24V2 versions through 2.20.0) contains a critical unauthenticated SQL injection flaw enabling attackers to remotely extract…

How to fix or mitigate CVE-2026-40810?

Within 24 hours: Inventory all systems running mbCONNECT24, mymbCONNECT24, myREX24V2, or myREX24V2.virtual versions 2.20.0 and earlier; isolate from untrusted networks. Within 7 days: Implement firewall rules restricting access to authorized IP ranges only; enable database activity logging with alerts for SQL injection patterns. Within 30 days: Establish patch timeline with Red Lion; plan upgrade path to patched version when available; evaluate alternative remote-maintenance solutions if remediation timeline exceeds acceptable risk window.

mbCONNECT24 CVE-2026-40810

Q: What is the CVSS score of CVE-2026-40810?

CVE-2026-40810 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32110 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-4563-rxxv-48gh

SQLi

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:43 vuln.today

DescriptionCVE.org

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

AnalysisAI

SQL injection in the MB connect line / Red Lion remote-maintenance platform (mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual, all versions up to and including 2.20.0) lets a remote, unauthenticated attacker inject crafted SQL into the userinfo endpoint, resulting in total loss of confidentiality of the backing database. The flaw was reported by CERT@VDE (advisory VDE-2026-044) and tracked in the ENISA EUVD as EUVD-2026-32110. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), but the CVSS 4.0 base score is 8.7 and CISA's SSVC framework rates the issue as automatable.

Technical ContextAI

The affected products are industrial remote-access and remote-maintenance gateways/portals from MB connect line (Red Lion): the mbCONNECT24/mymbCONNECT24 server platform and the myREX24V2 / myREX24V2.virtual remote-service portals, typically used to reach PLCs and machinery across OT networks. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled input reaching the userinfo endpoint is concatenated into a SQL SELECT statement without proper escaping or parameterization, so attacker-supplied SQL syntax is interpreted by the database engine. Per the EUVD CPE/version data the defect is present in the 2.x line through 2.20.0 across all four product variants; no per-component CPE strings beyond product+version were supplied.

RemediationAI

Consult the CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the fixed release and upgrade beyond the affected 2.20.0 line; an exact patched version number was not present in the available data and should be taken from that advisory rather than assumed. Because all variants through 2.20.0 are affected and the entry point is the network-facing userinfo endpoint, suitable compensating controls until patched include restricting network access to the management/portal interface to trusted source IPs via firewall or VPN (trade-off: may break legitimate remote-maintenance access from field locations and roaming technicians), placing the platform behind a WAF with rules targeting SQL metacharacters on the userinfo endpoint (trade-off: signature evasion is possible and may produce false positives), and monitoring database/web logs for anomalous queries or errors originating from that endpoint. Avoid exposing these OT remote-access portals directly to the internet.