Summary
Two command injection vulnerabilities have been discovered in MB connect line mbNET/mbNET.rokey/mbNET.mini.
Details
Impact
The vulnerabilities allow for command injection in mbNET/mbNET.rokey/mbNET.mini with varying prerequisites resulting in full system compromise.
Remediation
Update:
- mbNET/mbNET.rokey: 8.4.5
- mbNET.mini: 3.0.3
Vulnerabilities 2
-
High 8.4
Command injection via USB
A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
-
High 7.2
Command injection via malicious configuration
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can res…
Revision history
-
#1.0.0
Initial revision.
References
-
Product security incident reports
https://mbconnectline.com/security-advice
-
Security Incident Management SIM#2026-01-2 - PDF
https://advisories.mbconnectline.com/pdf/SIM2026-01-2.pdf
-
CERT@VDE Security Advisories for MB connect line
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2026-054: MB connect line: Multiple vulnerabilities in mbNET/mbNET.rokey/mbNET.mini - HTML
https://certvde.com/en/advisories/VDE-2026-054