Description
Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | MB connect line mbCONNECT24 | 0.0.0 – ≤ 2.19.3 | — |
| MB connect line | mymbCONNECT24 | 0.0.0 – ≤ 2.19.3 | — |
| Helmholz | myREX24V2 | 0.0.0 – ≤ 2.19.3 | — |
| Helmholz | myREX24V2.virtual | 0.0.0 – ≤ 2.19.3 | — |
Advisories 2
- VDE-2026-025 Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual CERT@VDE · Mar 23, 2026
- VDE-2026-024 MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 CERT@VDE · Mar 23, 2026