MB
Product
mbCONNECT24
54
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 25Medium 27Low 0
Watch
Add mbCONNECT24 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33613 | 8.8 | Apr 2 | MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray Affected: 0.0.0 through 2.19.4 |
| CVE-2025-3090 | 8.2 | Jun 24 | MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24 Affected: before 2.18.0 |
| CVE-2024-45273 | 7.8 | Oct 15 | MB connect line/Helmholz: Weak encryption of configuration file Affected: 0.0.0 through 2.16.2 |
| CVE-2026-40850 | 7.5 | May 27 | Unauthenticated SQLi in getAccountData function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40819 | 7.5 | May 27 | Unauthenticated SQLi in sync_data24 task Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40818 | 7.5 | May 27 | Unauthenticated SQLi in _mb24confi_getDevice function function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40817 | 7.5 | May 27 | Unauthenticated SQLi in getAlarmProfiles function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40816 | 7.5 | May 27 | Unauthenticated SQLi in _mb24confi_getTagAlarm function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40815 | 7.5 | May 27 | Unauthenticated SQLi in _mb24api_getUserAccount function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40814 | 7.5 | May 27 | Unauthenticated SQLi in _mb24confi_getTagAlarm function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40813 | 7.5 | May 27 | Unauthenticated SQLi in getLiveValues Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40812 | 7.5 | May 27 | Unauthenticated SQLi in getLiveValues function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40811 | 7.5 | May 27 | Unauthenticated SQLi in ssoabstractservice Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40810 | 7.5 | May 27 | Unauthenticated SQLi in userinfo Endpoint Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-33616 | 7.5 | Apr 2 | MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint Affected: 0.0.0 through 2.19.4 |
| CVE-2026-33614 | 7.5 | Apr 2 | MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint Affected: 0.0.0 through 2.19.4 |
| CVE-2025-3092 | 7.5 | Jun 24 | MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24 Affected: before 2.16.5 |
| CVE-2025-3091 | 7.5 | Jun 24 | MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 Affected: before 2.16.5 |
| CVE-2024-45272 | 7.5 | Oct 15 | MB connect line/Helmholz: Generation of weak passwords vulnerability Affected: 0.0.0 through 2.16.2 |
| CVE-2026-14448 | 7.2 | Jul 20 | Authenticated RCE in system_certificates view Affected: 1.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-10521 | 7.2 | Jun 23 | Authenticated unintended access to critical program parameters Affected: 0.0.0 before 2.20.2; 2.20.1 |
| CVE-2026-40836 | 7.1 | May 27 | Authenticated SQLi in inmessage model Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40834 | 7.1 | May 27 | Authenticated SQLi in saveDashboardLayout function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2026-40833 | 7.1 | May 27 | Authenticated SQLi in saveDashboardLayout function Affected: 0.0.0 through 2.20.0; 2.20.0 |
| CVE-2024-23942 | 7.1 | Mar 18 | MB connect line: Configuration File on the client workstation is not encrypted Affected: before 2.16.2 |
Showing 25