Which versions of mbCONNECT24 are affected by EUVD-2026-32127?

SQL injection in Helmholz industrial remote-access portals (mbCONNECT24, mymbCONNECT24, myREX24V2) enables privileged attackers to exfiltrate complete operational databases and modify system records.

How to fix or mitigate EUVD-2026-32127?

Within 24 hours: identify and catalog all mbCONNECT24, mymbCONNECT24, myREX24V2, and virtual variants in production; restrict network access to these systems to approved administrative networks only. Within 7 days: implement database-level least-privilege access controls, disable the DevSerialReset function if not operationally required, and enable comprehensive SQL audit logging on all queries. Within 30 days: contact Helmholz/Siemens for patch availability timeline and evaluate alternative remote-access solutions as contingency pending patch release.

mbCONNECT24 EUVD-2026-32127

Q: What is the CVSS score of EUVD-2026-32127?

EUVD-2026-32127 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-40823 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-5r32-5pqx-5hhc

SQLi

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:02 vuln.today

DescriptionCVE.org

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

AnalysisAI

SQL injection in the DevSerialReset function of MB connect line / Helmholz industrial remote-access portals (mbCONNECT24, mymbCONNECT24, myREX24V2, and the .virtual variants) lets a high-privileged remote attacker read the entire backend database and modify values in a non-critical table. The flaw stems from improper neutralization of special elements within a SQL UPDATE statement (CWE-89), yielding total loss of confidentiality and partial integrity impact. There is no public exploit identified at time of analysis, and EPSS rates exploitation likelihood very low (0.03%, 10th percentile).

Technical ContextAI

The affected systems are industrial remote-maintenance/VPN cloud portals from the MB connect line (Helmholz/Red Lion) product family - mbCONNECT24 and the myREX24V2 white-label/virtual editions - used to broker secure remote access to PLCs and field devices. The vulnerability is a classic CWE-89 SQL injection: user-controlled input reaches a backend SQL UPDATE command without proper sanitization in the server-side DevSerialReset function (related to device serial reset handling). Because the injection point is an UPDATE statement, an attacker can leverage techniques such as sub-queries or UNION/error/blind extraction to read arbitrary data while the write surface is limited to the affected query's target. The 'SQLi' tag and CWE-89 from the CERT@VDE report (VDE-2026-044, EUVD-2026-32127) corroborate the root cause.

RemediationAI

No exact fixed version was included in the provided data - the affected ranges all top out at 2.20.0, so consult CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the vendor-released patched build and upgrade mbCONNECT24/mymbCONNECT24/myREX24V2/myREX24V2.virtual accordingly once confirmed. Patch status is best described as 'Patch available per vendor advisory' pending version confirmation. Because exploitation requires a high-privileged account, the most effective compensating controls are tightening administrative access: review and minimize accounts that hold high privileges on the portal, enforce strong authentication and MFA on those accounts, and audit logs for anomalous use of device/serial-reset functionality. Where feasible, restrict network reachability of the management interface to trusted operator networks or via VPN/ACLs to shrink the remote attack surface; the trade-off is reduced convenience for distributed administrators. Avoid sharing high-privilege credentials across operators so that any abuse is attributable.