Which versions of mbCONNECT24 are affected by CVE-2026-40835?

MB connect line mbCONNECT24 and myREX24 industrial remote-maintenance gateways (versions ≤2.20.0) contain a SQL injection vulnerability that could expose the entire backend database to low-privileged…

How to fix or mitigate CVE-2026-40835?

Within 24 hours: inventory all mbCONNECT24 and myREX24 deployments at versions 2.20.0 and earlier; map network accessibility. Within 7 days: implement network segmentation restricting remote access to gateways; enable database query logging with alerting for unusual SELECT activity. Within 30 days: monitor vendor advisory VDE-2026-044 and EUVD-2026-32134 for patch release; develop and test upgrade procedure for all affected systems.

mbCONNECT24 CVE-2026-40835

Q: What is the CVSS score of CVE-2026-40835?

CVE-2026-40835 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32134 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-29h3-fj72-mp7v

SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:04 vuln.today

DescriptionCVE.org

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

AnalysisAI

SQL injection in the MB connect line mbCONNECT24 / myREX24 family of industrial remote-maintenance gateways (all listed editions through 2.20.0) lets a low-privileged remote user feed crafted input into a SQL SELECT statement assembled by the saveObjectFromData function, exposing the full backend database for reading. Reported by CERT@VDE (advisory VDE-2026-044, EUVD-2026-32134), the issue is a confidentiality-only impact (CVSS 4.0 base 7.1, VC:H/VI:N/VA:N). No public exploit code and no CISA KEV listing exist at this time, and EPSS is very low (0.03%, 11th percentile), indicating no observed mass exploitation.

Technical ContextAI

The affected products - mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual - are web-managed industrial remote-access/VPN platforms used to reach machinery and OT assets remotely. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the server-side saveObjectFromData routine concatenates attacker-controllable values directly into a SQL SELECT query without parameterization or escaping, so injected syntax is interpreted as part of the query. Because the impacted statement is a SELECT and the CVSS vector marks only confidentiality as affected (VI:N/VA:N), the practical effect is database read/exfiltration (UNION/boolean/blind extraction) rather than data modification or destruction.

RemediationAI

No vendor-released patch version is identified in the provided data; the affected range is bounded at and below 2.20.0, so consult CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the corrected release and upgrade all instances of mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual accordingly. Until a fixed build is applied, reduce exposure by restricting reachability of the management web portal to trusted networks or a VPN/jump host and placing these gateways behind firewall rules rather than exposing them to the internet (trade-off: may complicate legitimate remote-maintenance workflows), and by tightening account provisioning so only necessary low-privilege users exist and credentials are rotated, since the documented vector involves a low-privileged user (trade-off: added administrative overhead). Monitor application and database logs for anomalous SELECT patterns or errors originating from the object-save functionality.