EUVD-2026-32149
GHSA-f76g-mggc-7f2m
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionNVD
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
AnalysisAI
Unauthenticated SQL injection in mbCONNECT24 and the related MB connect line / Helmholz remote-maintenance portals (myREX24V2, myREX24V2.virtual, mymbCONNECT24) version 2.20.0 and earlier lets a remote attacker reach the getAccountData function and inject crafted input into its SQL SELECT statement. Because authentication is not required, an attacker can read arbitrary database contents, resulting in total loss of confidentiality, though integrity and availability are unaffected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify and document all instances of mbCONNECT24, myREX24V2, myREX24V2.virtual, and mymbCONNECT24 running v2.20.0 or earlier; assess exposure to untrusted networks. Within 7 days: Restrict portal access to authorized personnel and networks via IP whitelisting or VPN enforcement; enable detailed audit logging on database queries; establish monitoring for SQL injection patterns; request patch timeline from vendor (MB or Helmholz). …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today