Which versions of mbCONNECT24 are affected by CVE-2026-40847?

The mbCONNECT24 family of industrial remote-maintenance portals (versions 0.0.0-2.20.0) contains a SQL injection vulnerability that allows authenticated low-privilege users to extract arbitrary…

How to fix or mitigate CVE-2026-40847?

Within 24 hours: identify all mbCONNECT24 deployments and document current versions in use. Within 7 days: restrict network access to these systems to essential personnel only, deploy WAF rules to block SQL injection patterns in the system_tag parameter, and disable the system_tag view if operationally non-critical. Within 30 days: contact vendor directly for patch timeline; if no ETA is provided within 15 days, escalate to procurement to evaluate replacement solutions or alternative remote-maintenance platforms.

mbCONNECT24 CVE-2026-40847

Q: What is the CVSS score of CVE-2026-40847?

CVE-2026-40847 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32146 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-v5f5-m9wg-mcq9

SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:25 vuln.today

DescriptionCVE.org

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

AnalysisAI

SQL injection in the system_tag view of the mbCONNECT24 family of industrial remote-maintenance portals (mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual) versions 0.0.0 through 2.20.0 lets a remote attacker manipulate a SQL SELECT statement and read arbitrary database contents, yielding a total loss of confidentiality (CVSS 4.0 7.1, VC:H). The CVSS vector indicates a low-privileged account is required (PR:L), though the description text describes the flaw as 'unauthenticated' - this discrepancy should be verified with the vendor. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 11th percentile), consistent with CISA SSVC scoring exploitation as 'none.'

Technical ContextAI

The affected products are CERT@VDE-tracked industrial remote-access / VPN portal platforms (mbCONNECT24 and its myREX24V2/mymbCONNECT24 variants, including the .virtual deployment) used to broker remote maintenance connections to OT/ICS equipment. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaching the 'system_tag' view is concatenated into a SQL SELECT command without proper escaping or parameterization, allowing an attacker to break out of the intended query context. Because impact is scoped to confidentiality only (VC:H, VI:N, VA:N), the injection appears limited to data exfiltration via the SELECT path rather than write/modify or stacked-query operations. No CPE strings were supplied; affected products and versions are taken from the ENISA EUVD version list.

RemediationAI

Consult vendor advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) and upgrade to a release later than 2.20.0; an exact fixed version was not present in the available data, so confirm the specific patched build directly from that advisory before deploying. Until patched, reduce exposure with concrete compensating controls: place the portal behind a VPN or IP allowlist so the management/portal interface is not internet-reachable (trade-off: may break legitimate remote-maintenance access from arbitrary networks), tighten provisioning so that the low-privilege accounts that satisfy the PR:L requirement are minimized and audited, and enable database/application logging plus a WAF rule set to detect anomalous input reaching the system_tag view (trade-off: WAF signatures for SQLi can produce false positives and are not a substitute for the patch). No vendor-released patched version was independently confirmed from the provided data.