Which versions of mbCONNECT24 are affected by CVE-2026-40816?

MB connect line's remote-maintenance platforms (mbCONNECT24, mymbCONNECT24, myREX24V2 through version 2.20.0) are vulnerable to unauthenticated SQL injection, exposing organizations to unauthorized…

How to fix or mitigate CVE-2026-40816?

24 hours: Isolate affected portals to VPN or internal networks only; audit access logs for suspicious queries or repeated failed requests to mb24alarm.php. 7 days: Implement firewall rules restricting remote-maintenance portal access to known administrator IP addresses; enable database activity monitoring (DAM) to detect SQL injection patterns. 30 days: Contact MB connect line for patch release timeline and interim security guidance; identify alternative maintenance solutions; rotate all database credentials used by portal accounts and restrict to read-only where possible.

mbCONNECT24 CVE-2026-40816

Q: What is the CVSS score of CVE-2026-40816?

CVE-2026-40816 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32121 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-7845-cw4c-743q

SQLi PHP

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:59 vuln.today

DescriptionCVE.org

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

AnalysisAI

SQL injection in MB connect line's mbCONNECT24, mymbCONNECT24, and myREX24V2 remote-maintenance portals (all versions up to and including 2.20.0) lets an unauthenticated remote attacker inject crafted SQL through the _mb24confi_getTagAlarm function in mb24alarm.php, resulting in a total loss of database confidentiality. The CVSS 4.0 base score of 8.7 reflects network reach with no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), but impact is scoped to confidentiality only (VC:H, VI:N, VA:N) - an attacker can read data but cannot directly alter or disrupt the system through this flaw. No public exploit identified at time of analysis, and the EPSS score is very low (0.05%, 15th percentile), indicating no observed broad exploitation activity despite the high base score.

Technical ContextAI

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected code is a PHP backend (tagged PHP, SQLi) in which the _mb24confi_getTagAlarm function in mb24alarm.php builds a SQL SELECT statement using attacker-influenced input without proper sanitization or parameterization, allowing the input to break out of its intended context and modify the query. The impacted products - mbCONNECT24, mymbCONNECT24, and the myREX24V2 / myREX24V2.virtual family - are MB connect line (Red Lion) industrial remote-access and remote-maintenance portal platforms used to reach field equipment, so the underlying database typically holds configuration, alarm/tag, device, and account data. No CPE strings were provided in the input, so exact platform identifiers cannot be confirmed beyond the vendor/version list supplied by the ENISA EUVD entry.

RemediationAI

Consult the CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the fixed release and apply the vendor-supplied update for your specific product (mbCONNECT24, mymbCONNECT24, myREX24V2, or myREX24V2.virtual); the input data does not specify an exact patched version, so the fix version is not independently confirmed here and should be taken from the advisory rather than assumed beyond 2.20.0. Until the update is applied, reduce exposure by restricting network reachability of the portal and the mb24alarm.php endpoint to trusted management networks or VPN rather than the open internet, which limits attacker access but may inconvenience legitimate remote operators; placing a web application firewall in front of the portal to block SQL-injection patterns against the alarm/tag parameters can add a detection-and-blocking layer, though WAF rules can be bypassed and should not be treated as a complete fix. Monitor portal and database logs for anomalous SELECT activity and rotate any credentials or secrets that may have been exposed if compromise is suspected.