Description
An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | MB connect line mbCONNECT24 | 0.0.0 – ≤ 2.19.3 | — |
| MB connect line | mymbCONNECT24 | 0.0.0 – ≤ 2.19.3 | — |
| Helmholz | myREX24V2 | 0.0.0 – ≤ 2.19.3 | — |
| Helmholz | myREX24V2.virtual | 0.0.0 – ≤ 2.19.3 | — |
Advisories 2
- VDE-2026-025 Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual CERT@VDE · Mar 23, 2026
- VDE-2026-024 MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 CERT@VDE · Mar 23, 2026