Which versions of mbCONNECT24 are affected by CVE-2026-40814?

Organizations using MB connect line's mbCONNECT24 remote-maintenance platform face exposure to unauthorized database access by attackers who require no credentials to initiate an attack, potentially…

How to fix or mitigate CVE-2026-40814?

24 hours: Audit all network connectivity to mbCONNECT24 instances (version 2.20.0 and earlier); restrict external access via firewall rules and implement network segmentation to limit exposure to trusted internal networks only. 7 days: Deploy Web Application Firewall (WAF) rules targeting SQL injection payloads in dataapi.php; enable database activity monitoring (DAM) to detect anomalous queries; document current versions and patch status in asset inventory. 30 days: Contact MB connect line to obtain patch timeline and test availability; prepare upgrade or system replacement roadmap if patch unavailable; implement database least-privilege access controls and comprehensive audit logging.

mbCONNECT24 CVE-2026-40814

Q: What is the CVSS score of CVE-2026-40814?

CVE-2026-40814 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32119 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-pgpg-4wf6-rfx5

SQLi PHP

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:59 vuln.today

DescriptionCVE.org

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

AnalysisAI

SQL injection in MB connect line's mbCONNECT24 remote-maintenance platform (and the related myREX24V2, mymbCONNECT24 and myREX24V2.virtual products through version 2.20.0) lets unauthenticated remote attackers read arbitrary database contents. The flaw lives in the _mb24confi_getTagAlarm function of dataapi.php, where attacker-controlled input is concatenated into a SQL SELECT statement, yielding a total loss of confidentiality. There is no public exploit identified at time of analysis, the EPSS probability is very low (0.05%), and the issue is not on CISA KEV; it was reported by CERT@VDE (advisory VDE-2026-044).

Technical ContextAI

The affected software is MB connect line's mbCONNECT24/myREX24 family of industrial remote-maintenance and secure-remote-access gateways used to reach machines, PLCs and IoT devices over the internet. The vulnerable component is a PHP backend endpoint (dataapi.php) and specifically its _mb24confi_getTagAlarm function, which handles tag/alarm configuration data. The root cause is CWE-89 (improper neutralization of special elements used in a SQL command): untrusted input is passed into a SQL SELECT query without parameterization or proper escaping, allowing an attacker to alter the query's logic. No CPE strings were provided in the source data, so exact CPE identifiers should be taken from the vendor/EUVD records (EUVD-2026-32119).

RemediationAI

No exact fixed version was included in the provided data, so the released patched version cannot be independently confirmed here; consult the CERT@VDE vendor advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the official fixed release and upgrade beyond 2.20.0 as the primary remediation. Until a confirmed patched version is applied, reduce exposure of the dataapi.php endpoint by restricting network access to the management/API interface (allowlist known administrator IPs or place it behind a VPN), since these gateways should rarely expose their backend API directly to the public internet - the trade-off is that legitimate remote administration must come through the restricted path. If a web application firewall is in front of the platform, add rules to inspect and block SQL metacharacters on the affected endpoint, accepting the usual WAF trade-off of possible false positives and incomplete coverage. Avoid running the application's database account with excessive privileges to limit the blast radius of any successful injection.