Summary
There is a vulnerability in mbCONNECT24/mymbCONNECT24 that allows an authenticated remote attacker to access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters.
Details
Impact
CVE-2026-10521 allows an authenticated remote attacker to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.
Remediation
Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.2.
Vulnerabilities 1
-
High 7.2
Authenticated unintended access to critical program parameters
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.
Revision history
-
#1.0.0
Initial revision.
References
-
Product security incident reports
https://mbconnectline.com/security-advice
-
Security Incident Management SIM#2026-04 - PDF
https://advisories.mbconnectline.com/pdf/SIM2026-04.pdf
-
CERT@VDE Security Advisories for MB connect line
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2026-068: MB connect line: Authenticated unintended access to critical program parameters in mbCONNECT24/mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2026-068