Which versions of mbCONNECT24 are affected by EUVD-2026-32159?

MB connect line's remote-access maintenance portals (mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2.virtual versions 2.20.0 and earlier) contain a SQL injection vulnerability in the UpdateParam…

How to fix or mitigate EUVD-2026-32159?

24 hours: identify all systems running affected MB connect line portal versions (2.20.0 and earlier). 7 days: restrict network access to admin.mbnetj.php to known-good IP ranges, enable SQL transaction logging with alerting on UpdateParam execution, and enforce principle of least privilege on database service accounts. 30 days: contact MB connect line for patch timeline and test-validate any available updates in a non-production environment; conduct database integrity audit to verify no prior unauthorized modifications.

mbCONNECT24 EUVD-2026-32159

Q: What is the CVSS score of EUVD-2026-32159?

EUVD-2026-32159 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-40830 HIGH

SQL Injection (CWE-89)

2026-05-27 info@cert.vde.com

GHSA-9636-x77x-g7vw

SQLi PHP

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:56 vuln.today

DescriptionCVE.org

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

AnalysisAI

SQL injection in the UpdateParam function of admin.mbnetj.php in MB connect line's mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual remote-maintenance portals (versions up to and including 2.20.0) lets a high-privileged remote attacker tamper with a SQL UPDATE command, reading the entire database and modifying values in a non-critical table. The flaw was reported by CERT@VDE (advisory VDE-2026-044) and carries CVSS 4.0 base 7.0. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and CISA SSVC rates exploitation as 'none' - indicating low immediate real-world urgency despite the high impact ceiling.

Technical ContextAI

The affected products are industrial remote-access and remote-maintenance cloud/appliance portals from MB connect line GmbH (the mbCONNECT24 / myREX24 family, including the 'virtual' variant), implemented in PHP as indicated by the input tags (PHP, SQLi). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the UpdateParam function in admin.mbnetj.php incorporates attacker-influenced input into a SQL UPDATE statement without proper sanitization or parameterization. Because the injection sits in an UPDATE command, the attacker can both exfiltrate data via the query and write into at least one (described as non-critical) table. The EUVD CPE/version data scopes this to all four product editions at versions 0.0.0 through 2.20.0.

RemediationAI

No vendor-released fixed version is identified in the available data; all editions at 2.20.0 and below are listed as affected, so consult CERT@VDE advisory VDE-2026-044 (https://www.certvde.com/en/advisories/VDE-2026-044/) for the patched release and upgrade to it once published. As compensating controls until patched: restrict network access to the administrative interface and the admin.mbnetj.php endpoint to trusted management networks or VPN only (trade-off: legitimate remote admins must connect through that path), tightly limit and audit accounts holding the high privileges the exploit requires since PR:H is in the CVSS vector (trade-off: may slow routine administration), and monitor application/database logs for anomalous UPDATE statements or unexpected reads against the admin endpoint. Because the writable target is described as a non-critical table, integrity exposure is limited, but the full-database read capability means treating any successful exploitation as a confidentiality breach is appropriate.