Mbconnectline

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-33617 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Apr 2, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.
CVE-2026-33616 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Apr 2, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a...Show more An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-33615 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Apr 2, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total...Show more An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.Show less
CVE-2026-33614 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Apr 2, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total...Show more An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-33613 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Apr 2, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability c...Show more Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.Show less
CVE-2025-41681 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 4.8 MEDIUM· v3 N/A· v2 A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.
CVE-2025-41679 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.
CVE-2025-41678 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.
CVE-2025-41677 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession.
CVE-2025-41676 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 4.9 MEDIUM· v3 N/A· v2 A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession.
CVE-2025-41675 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.
CVE-2025-41674 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.
CVE-2025-41673 1Mbconnectline 1Mbnet.mini Firmware Jun 17, 2026 Jul 21, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.
CVE-2024-45276 2Helmholz Mbconnectline 2Mbnet.mini Firmware Rex 100 Firmware Jun 17, 2026 Oct 15, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.
CVE-2024-45275 2Helmholz Mbconnectline 2Mbnet.mini Firmware Rex 100 Firmware Jun 17, 2026 Oct 15, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
CVE-2024-45274 2Helmholz Mbconnectline 2Mbnet.mini Firmware Rex 100 Firmware Jun 17, 2026 Oct 15, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.
CVE-2024-45273 2Helmholz Mbconnectline 15Mbconnect24 Mbnet.mini FirmwareMbnet.rokey Firmware+12 more Jun 17, 2026 Oct 15, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
CVE-2024-45272 2Helmholz Mbconnectline 13Mbconnect24 Mbnet.rokey FirmwareMbnet Firmware+10 more Jun 17, 2026 Oct 15, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
CVE-2024-45271 2Helmholz Mbconnectline 2Mbnet.mini Firmware Rex 100 Firmware Jun 17, 2026 Oct 15, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.
CVE-2023-4834 2Helmholz Mbconnectline 4Mbconnect24 Mymbconnect24Myrex24+1 more Jun 17, 2026 Oct 16, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain re...Show more In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to. Show less

12 3 Next