This vulnerability (CVE-2026-40851) affects MB connect line's mbNET/mbNET.rokey products due to improper validation of input types (CWE-1287) in the cfgparser module. A local attacker can exploit this by placing a specially crafted file on a USB stick, which when parsed, leads to code execution. The attack vector is local with low attack complexity and no privileges or user interaction required. The impact includes complete loss of confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.4, reflecting the high severity of this issue. No patch or official remediation level has been published yet.

Exploitation of this vulnerability allows a local attacker to execute arbitrary code on the affected device, resulting in total compromise of confidentiality, integrity, and availability. This means sensitive data could be exposed or altered, and system operations could be disrupted or controlled by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to devices to prevent local attackers from introducing malicious USB files. Monitor vendor communications for updates on patches or mitigations.