Critical · 9.1 CVE-2026-33615 EUVD-2026-18176

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint

Published Apr 2, 2026 · Updated Apr 2, 2026 · Assigned by CERTVDE

Vendor: MB connect line Product: mbCONNECT24 Product: mymbCONNECT24

Description

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

Affected products

Vendor	Product	Affected	Fixed
MB connect line	mbCONNECT24	0.0.0 – ≤ 2.19.4	—
MB connect line	mymbCONNECT24	0.0.0 – ≤ 2.19.4	—

Advisories 2

VDE-2026-043 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual CERT@VDE · May 22, 2026
VDE-2026-030 MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 CERT@VDE · Apr 2, 2026

References

https://certvde.com/de/advisories/VDE-2026-030 vendor-advisory
https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json vendor-advisory