This vulnerability (CVE-2026-40852) affects MB connect line mbNET/mbNET.rokey devices. It arises from improper neutralization of special elements in OS commands (CWE-78). Specifically, a highly authenticated attacker can alter the configuration generator by injecting payloads that are not properly checked before being passed to system execution functions. This leads to OS command injection and arbitrary code execution on the affected device. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was published on May 27, 2026, and no patch or official remediation level has been disclosed by the vendor. The device is not a cloud service, so remediation depends on vendor updates to the product firmware or software.

Successful exploitation allows a highly authenticated attacker to execute arbitrary OS commands on the device by injecting malicious payloads into configuration files. This can lead to complete loss of confidentiality, integrity, and availability of the affected mbNET/mbNET.rokey device, potentially resulting in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor MB connect line advisories for updates. Until a fix is available, restrict access to highly authenticated users and limit exposure of the configuration generator functionality to trusted personnel only.