Summary
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
Details
Impact
CVE-2026-32968 allows unauthenticated RCE resulting in full system compromise impacting confidentiality, integrity, and availability, while CVE-2026-32969 allows unauthenticated SQLi resulting in arbitrary read access to the complete database.
Remediation
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.
Vulnerabilities 2
-
Critical 9.8
Unauthenticated RCE in com_mb24sysapi
Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE…
-
High 7.5
Pre-Auth Blind SQLi in userinfo Endpoint
An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confide…
Revision history
-
#1.0.0
Initial revision.
References
-
Product security incident reports
https://mbconnectline.com/security-advice
-
Security Incident Management SIM#2026-02 - PDF
https://advisories.mbconnectline.com/pdf/SIM2026-02.pdf
-
CERT@VDE Security Advisories for MB connect line
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2026-024: MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2026-024