Which versions of mbCONNECT24 are affected by EUVD-2026-32158?

SQL injection in MB connect line remote-access portals (mbCONNECT24, myREX24V2, mymbCONNECT24, myREX24V2.virtual) versions ≤2.20.0 allows attackers with high-privileged account access to extract and…

How to fix or mitigate EUVD-2026-32158?

Within 24 hours: identify all systems running mbCONNECT24, myREX24V2, mymbCONNECT24, or myREX24V2.virtual at versions ≤2.20.0. Within 7 days: contact vendor for patch status and timeline. Within 30 days: deploy interim compensating controls listed below while monitoring for vendor patch release.

mbCONNECT24 EUVD-2026-32158

Q: What is the CVSS score of EUVD-2026-32158?

EUVD-2026-32158 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-40829 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-c7cf-4964-3r7f

SQLi PHP

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:46 vuln.today

DescriptionCVE.org

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

AnalysisAI

SQL injection in the UpdateParam function of view.html.php affects MB connect line remote-access portals (mbCONNECT24, myREX24V2, mymbCONNECT24, and myREX24V2.virtual) in versions up to and including 2.20.0, letting an attacker inject into a SQL UPDATE statement to read the entire backend database and alter values in a non-critical table. The CVSS 4.0 vector (PR:H) indicates a high-privileged account is required, even though the advisory text labels the flaw 'unauthenticated' - a discrepancy defenders should resolve with the vendor. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC rates exploitation as 'none'.

Technical ContextAI

The affected products are industrial remote-maintenance and VPN portal platforms from MB connect line (myREX24V2, myREX24V2.virtual, mbCONNECT24, mymbCONNECT24), implemented in PHP as indicated by the 'PHP' tag. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-controllable input reaches the UpdateParam function in view.html.php and is concatenated into a SQL UPDATE command without proper sanitization or parameterization. Because the injection occurs in an UPDATE context, the database engine permits both data exfiltration (e.g., via sub-selects or UNION-style reads against other tables) and modification of the targeted writable table, which the vendor characterizes as non-critical.

RemediationAI

No exact fixed version is included in the provided data; absence of that field is not confirmation that no patch exists, so consult the CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the vendor-released patched version and upgrade all instances of myREX24V2, myREX24V2.virtual, mbCONNECT24, and mymbCONNECT24 beyond 2.20.0 as the primary fix. Until a patched build is applied, restrict network reachability of the portal - limit access to the view.html.php interface and the administrative portal to trusted management networks or VPN-only, since the vector is network-based (AV:N), which reduces exposure at the cost of remote-management convenience. Because exploitation per the CVSS vector requires a high-privilege account (PR:H), tighten privileged-account hygiene (rotate and minimize high-privilege portal credentials, enforce MFA where supported) to shrink the set of accounts that could trigger the injection; verify the conflicting 'unauthenticated' claim in the description with the vendor before relying on this control.