High severity · published Apr 2, 2026
CVE-2026-33613
MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise.
This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
mbCONNECT24 · MB connect line
0.0.0 through 2.19.4 · source: vendor, NVD
MY
mymbCONNECT24 · MB connect line
0.0.0 through 2.19.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33613
Third Party Advisory
https://certvde.com/de/advisories/VDE-2026-030
Vendor Advisory
https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json
More from mbCONNECT24
9.1
CVE-2026-33615
MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint
8.2
CVE-2025-3090
MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24
7.5
CVE-2026-40850
Unauthenticated SQLi in getAccountData function
7.5
CVE-2026-40819
Unauthenticated SQLi in sync_data24 task
7.5
CVE-2026-40818
Unauthenticated SQLi in _mb24confi_getDevice function function