Summary
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24.
Details
Impact
CVE-2026-14448 allows an highly authenticated attacker for to run arbitrary system commands in mbCONNECT24/mymbCONNECT24 resulting in a total loss of confidentiality, availability and integrity.
All remaining vulnerabilities allow for SQLi in mbCONNECT24/mymbCONNECT24 resulting in varying access to the database.
For specific details, see CVE description.
Remediation
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.
Vulnerabilities 41
-
High 7.5
Unauthenticated SQLi in userinfo Endpoint
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
High 7.5
Unauthenticated SQLi in ssoabstractservice
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
High 7.5
Unauthenticated SQLi in getLiveValues function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidenti…
-
High 7.5
Unauthenticated SQLi in getLiveValues
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confide…
-
High 7.5
Unauthenticated SQLi in _mb24confi_getTagAlarm function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss …
-
High 7.5
Unauthenticated SQLi in _mb24api_getUserAccount function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentialit…
-
High 7.5
Unauthenticated SQLi in _mb24confi_getTagAlarm function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total los…
-
High 7.5
Unauthenticated SQLi in getAlarmProfiles function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
High 7.5
Unauthenticated SQLi in _mb24confi_getDevice function function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
High 7.5
Unauthenticated SQLi in sync_data24 task
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
High 7.5
Unauthenticated SQLi in getAccountData function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
High 7.2
Authenticated RCE in system_certificates view
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availab…
-
High 7.1
Authenticated SQLi in saveDashboardLayout function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database …
-
High 7.1
Authenticated SQLi in saveDashboardLayout function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole da…
-
High 7.1
Authenticated SQLi in inmessage model
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a no…
-
Medium 6.5
Authenticated SQLi in Easy View
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in getDevicegroups function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in saveObjectFromData function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in getProjectScalings function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in getDeviceScalings function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in getComponentScalings function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in VerifyCreateLicences function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in getProjectTags function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in getWidgetTags function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in alarming view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in dashboard view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in devices_configuration view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in system view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in system_tag view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in tag view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 6.5
Authenticated SQLi in user_alarmprofile view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 5.5
Authenticated SQLi in DevSerialReset function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values …
-
Medium 5.5
Authenticated SQLi in accountstatus view
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and chan…
-
Medium 5.5
Authenticated SQLi in accountstatus view
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and cha…
-
Medium 5.5
Authenticated SQLi in _RemoveRequest function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries…
-
Medium 5.5
Authenticated SQLi in DeleteSysLogEntry function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entr…
-
Medium 5.5
Authenticated SQLi in UpdateParam function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and…
-
Medium 5.5
Authenticated SQLi in UpdateParam function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database …
-
Medium 4.9
Authenticated SQLi in getAccountByID function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 4.9
Authenticated SQLi in DevSerialReset function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
-
Medium 4.9
Authenticated SQLi in dsgvo_contracts view
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Revision history
-
#2.0.0
Added missing CVE-2026-14448, Revised Summary and Impact accordingly, starting version
-
#1.0.0
Initial revision.
References
-
Product security incident reports
https://mbconnectline.com/security-advice
-
Security Incident Management SIM#2026-01-1 - PDF
https://advisories.mbconnectline.com/pdf/SIM2026-01-1.pdf
-
CERT@VDE Security Advisories for MB connect line
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2026-044: MB connect line: Multiple SQLi vulnerabilities in mbCONNECT24/mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2026-044