mbCONNECT24 CVE-2026-40821

Q: What is the CVSS score of CVE-2026-40821?

CVE-2026-40821 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32125 MEDIUM

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-vr4v-549x-p6j7

SQLi

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:38 vuln.today

DescriptionCVE.org

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

AnalysisAI

SQL injection in the getAccountByID function of MB connect line's mbCONNECT24, mymbCONNECT24, myREX24V2, and myREX24V2.virtual industrial remote-access platforms (all versions up to and including 2.20.0) allows a high-privileged remote attacker to extract data from the underlying database via a crafted SELECT statement. The vulnerability is classified under CWE-89 with confidentiality impact rated High on the vulnerable component, while integrity and availability remain unaffected. No public exploit code exists and no KEV listing has been issued; EPSS (0.03%, 10th percentile) and SSVC signals both indicate low current exploitation likelihood.

Technical ContextAI

The affected products - mbCONNECT24, mymbCONNECT24, myREX24V2, and myREX24V2.virtual - are industrial IoT remote-access and VPN gateway platforms by MB connect line, commonly deployed in OT/ICS environments. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning attacker-controlled input is concatenated directly into a SQL SELECT statement within the getAccountByID function without adequate sanitization or use of parameterized queries. Because the injection point is in a SELECT path and the CVSS vector records VI:N/VA:N (no integrity or availability impact), this is a read-only SQL injection - likely allowing UNION-based or blind data extraction. Affected version strings from EUVD-2026-32125 confirm all four product variants at or below version 2.20.0 are impacted.

RemediationAI

Consult the CERT VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-044/ for the vendor-recommended patch version; no specific fixed release version was included in the available intelligence data, so the exact upgrade target should be confirmed directly from the advisory before applying. As a compensating control, restrict access to the mbCONNECT24 management interface to trusted IP ranges only, limiting exposure of the vulnerable getAccountByID endpoint to the smallest set of authorized high-privileged users; note this does not eliminate the vulnerability but reduces the attacker pool. Additionally, enforce the principle of least privilege on all platform accounts to minimize the number of high-privileged credentials that could be used to trigger the injection. Network-layer filtering of SQL metacharacters at a WAF or reverse proxy is not recommended as a primary control for industrial platforms where such filtering may break legitimate functionality.