Which versions of mbCONNECT24 are affected by CVE-2026-40833?

Virtual industrial remote-maintenance platforms from the mbCONNECT24/myREX24V2 family (versions ≤2.20.0) contain a SQL injection vulnerability in the dashboard configuration function that allows…

How to fix or mitigate CVE-2026-40833?

Within 24 hours: Inventory all affected instances; document version numbers and network accessibility. Within 7 days: Contact vendor for interim mitigation guidance; implement IP-based access controls restricting dashboard access to authorized administrative networks only. Within 30 days: Monitor vendor security advisories for patch availability; evaluate alternative remote-maintenance architectures or network segmentation to isolate critical operations.

mbCONNECT24 CVE-2026-40833

Q: What is the CVSS score of CVE-2026-40833?

CVE-2026-40833 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32132 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-qxpx-6hgq-8w3j

SQLi PHP

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:04 vuln.today

DescriptionCVE.org

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

AnalysisAI

SQL injection in the saveDashboardLayout function of dash.php affects the mbCONNECT24, myREX24V2, mymbCONNECT24, and myREX24V2.virtual industrial remote-maintenance platforms in versions up to and including 2.20.0. Because user-supplied input is improperly neutralized inside a SQL INSERT statement, a remote attacker can read the entire backend database and write rows into a non-critical table, yielding full loss of confidentiality and partial loss of integrity. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile).

Technical ContextAI

The affected products (myREX24V2, mbCONNECT24, mymbCONNECT24, myREX24V2.virtual) are PHP-based remote access and remote-maintenance portals from the MB connect line / Helmholz family, used to reach industrial equipment and PLCs over the internet. The flaw is classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the saveDashboardLayout routine in dash.php concatenates attacker-controlled dashboard-layout data into a SQL INSERT statement without parameterization or escaping, so injected SQL syntax is parsed by the database engine. The 'PHP' and 'SQLi' source tags and the reporting party (CERT@VDE) corroborate that this is a server-side web-application database injection rather than a client-side or transport issue.

RemediationAI

Consult CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) and upgrade to the fixed release identified there; the source data confirms all versions through 2.20.0 are affected but does not include an exact fixed version number, so the patched build must be taken from the advisory rather than assumed (no vendor-released patch version is independently confirmed from the available data). If patching cannot be done immediately, reduce exposure of these internet-facing remote-maintenance portals: restrict network access to the management/dashboard interface to trusted source IPs or a VPN (trade-off: legitimate remote technicians must connect through the allowed path), tighten and audit low-privileged portal accounts since the CVSS vector indicates an authenticated account is the exploitation prerequisite, and monitor database and web logs for anomalous INSERT activity or SQL errors originating from the dash.php saveDashboardLayout endpoint.