Which versions of mbCONNECT24 are affected by CVE-2026-40834?

Vulnerability in MB connect line remote access platforms (mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2.virtual, all versions through 2.20.0) allows authenticated users with low privilege to…

How to fix or mitigate CVE-2026-40834?

Within 24 hours: Inventory all systems running affected versions (up to 2.20.0) and identify critical data stored in the databases. Within 7 days: Implement network access controls restricting platform access to authorized administrators only, enable database activity monitoring for anomalous queries, and apply Web Application Firewall rules to block SQL injection patterns targeting dash_layout.php. Within 30 days: Contact vendor for patch availability timeline and initiate evaluation of platform upgrade or replacement solutions.

mbCONNECT24 CVE-2026-40834

Q: What is the CVSS score of CVE-2026-40834?

CVE-2026-40834 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32133 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-6mg8-8793-2qp7

SQLi PHP

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:04 vuln.today

DescriptionCVE.org

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

AnalysisAI

SQL injection in the saveDashboardLayout function of dash_layout.php in MB connect line's mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual remote-access platforms (all versions up to and including 2.20.0) lets a low-privileged remote attacker manipulate a SQL INSERT statement to read the entire backend database and write rows into a non-critical table. The flaw, reported by CERT@VDE (VDE-2026-044, EUVD-2026-32133), yields total loss of confidentiality and partial loss of integrity but no availability impact. EPSS is very low (0.03%, 11th percentile) and there is no public exploit identified at time of analysis, so this is a serious data-exposure bug rather than a mass-exploitation threat.

Technical ContextAI

The affected products are MB connect line (Red Lion) industrial remote-maintenance and secure-access portals used to manage VPN connections to OT/ICS devices and machines. The vulnerable code is a PHP server-side endpoint, dash_layout.php, whose saveDashboardLayout function builds a SQL INSERT command from user-supplied dashboard layout data without properly neutralizing special elements - the textbook root cause of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because the injection occurs inside an INSERT, the attacker leverages it both to exfiltrate arbitrary data from other tables (e.g., via sub-selects or stacked logic) and to write into a non-critical table; the tags 'PHP' and 'SQLi' corroborate this. No CPE strings were provided in the source data - affected scope is expressed only as EUVD vendor/version tuples.

RemediationAI

Upgrade to a fixed release as published in CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/); the input data does not include an exact patched version number, so the specific fix version must be confirmed directly from that advisory rather than assumed (all builds through 2.20.0 are listed as vulnerable). Until patched, restrict reachability of the management portal - place mbCONNECT24/myREX24V2 web interfaces behind a VPN or IP allowlist and segment them from untrusted networks, accepting that this reduces convenience of remote operator access. Apply least privilege to portal accounts so the low-privilege role used to reach dash_layout.php is granted only where strictly needed, which limits who can trigger the saveDashboardLayout function. Consider a WAF or reverse-proxy rule to inspect and block SQL-injection patterns on the dash_layout.php endpoint, noting this is a detection-prone stopgap that can produce false positives and should not replace the official fix.