CVE-2026-14448 | High | 7.2 | 2026-07-20 | An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralizati… |
CVE-2026-10521 | High | 7.2 | 2026-06-23 | An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters… |
CVE-2026-40852 | High | 7.2 | 2026-05-27 | A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking thi… |
CVE-2026-40851 | High | 8.4 | 2026-05-27 | A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a t… |
CVE-2026-40850 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of… |
CVE-2026-40849 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of sp… |
CVE-2026-40848 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements… |
CVE-2026-40847 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special e… |
CVE-2026-40846 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special eleme… |
CVE-2026-40845 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization o… |
CVE-2026-40844 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special el… |
CVE-2026-40843 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special ele… |
CVE-2026-40842 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of sp… |
CVE-2026-40841 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of s… |
CVE-2026-40840 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralizatio… |
CVE-2026-40839 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralizatio… |
CVE-2026-40838 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization o… |
CVE-2026-40837 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization… |
CVE-2026-40836 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special e… |
CVE-2026-40835 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization… |
CVE-2026-40834 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to i… |
CVE-2026-40833 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper… |
CVE-2026-40832 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of… |
CVE-2026-40831 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special element… |
CVE-2026-40830 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper… |
CVE-2026-40829 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper ne… |
CVE-2026-40828 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization o… |
CVE-2026-40827 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of s… |
CVE-2026-40826 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of spec… |
CVE-2026-40825 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutra… |
CVE-2026-40824 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutral… |
CVE-2026-40823 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of s… |
CVE-2026-40822 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of s… |
CVE-2026-40821 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of s… |
CVE-2026-40819 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special… |
CVE-2026-40818 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralizati… |
CVE-2026-40817 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization o… |
CVE-2026-40816 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to… |
CVE-2026-40815 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutraliz… |
CVE-2026-40814 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to i… |
CVE-2026-40813 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper ne… |
CVE-2026-40812 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutr… |
CVE-2026-40811 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of speci… |
CVE-2026-40810 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of specia… |
CVE-2026-33617 | Medium | 5.3 | 2026-04-02 | An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but ther… |
CVE-2026-33616 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of s… |
CVE-2026-33615 | Critical | 9.1 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special… |
CVE-2026-33614 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special… |
CVE-2026-33613 | High | 7.2 | 2026-04-02 | Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray functi… |
CVE-2026-32969 | High | 7.5 | 2026-03-23 | An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper ne… |
CVE-2026-32968 | Critical | 9.8 | 2026-03-23 | Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb… |
CVE-2025-41688 | High | 7.2 | 2025-07-31 | A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. |
CVE-2025-41681 | Medium | 4.8 | 2025-07-21 | A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. |
CVE-2025-41679 | Medium | 5.3 | 2025-07-21 | An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initia… |
CVE-2025-41678 | Medium | 6.5 | 2025-07-21 | A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL state… |
CVE-2025-41677 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast successio… |
CVE-2025-41676 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. |
CVE-2025-41675 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralizatio… |
CVE-2025-41674 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special el… |
CVE-2025-41673 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elem… |
CVE-2025-3092 | High | 7.5 | 2025-06-24 | An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint. |
CVE-2025-3091 | High | 7.5 | 2025-06-24 | An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password. |
CVE-2025-3090 | High | 8.2 | 2025-06-24 | An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function. |
CVE-2024-23943 | Critical | 9.1 | 2025-03-18 | An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availabili… |
CVE-2024-23942 | High | 7.1 | 2025-03-18 | A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prev… |
CVE-2024-45276 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. |
CVE-2024-45275 | Critical | 9.8 | 2024-10-15 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected device… |
CVE-2024-45274 | Critical | 9.8 | 2024-10-15 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. |
CVE-2024-45273 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. |
CVE-2024-45272 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in… |
CVE-2024-45271 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. |
CVE-2023-1779 | Medium | 4.3 | 2023-06-06 | Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtu… |
CVE-2023-0985 | High | 8.8 | 2023-06-06 | An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An… |
CVE-2022-22520 | Medium | 5.3 | 2022-09-14 | A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and H… |
CVE-2021-34580 | High | 7.5 | 2021-10-27 | In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted… |
CVE-2021-34575 | High | 7.5 | 2021-08-02 | In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the serv… |
CVE-2021-34574 | Medium | 4.3 | 2021-08-02 | In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the… |
CVE-2021-33527 | Critical | 9.8 | 2021-08-02 | In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM… |
CVE-2021-33526 | High | 7.8 | 2021-08-02 | In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing… |
CVE-2020-12530 | Medium | 4.3 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php all… |
CVE-2020-12529 | Medium | 5.8 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allo… |
CVE-2020-12528 | Medium | 6.5 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a lo… |
CVE-2020-12527 | Medium | 6.5 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access… |