MB connect line vulnerabilities and threats

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.

CVE-2026-33616 is a high-severity SQL Injection vulnerability in the mbCONNECT24 product by MB connect line. It allows an unauthenticated remote attacker to exploit a blind SQL Injection flaw in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This vulnerability can lead to a total loss of confidentiality of the affected system's data. The vulnerability has a CVSS score of 7.5, indicating a significant risk. There is no information about available patches or official fixes at this time. No known exploits are reported in the wild.

CVE-2026-33615 is a critical SQL Injection vulnerability in the mbCONNECT24 product by MB connect line. It allows an unauthenticated remote attacker to exploit improper neutralization of special elements in a SQL UPDATE command via the setinfo endpoint. This vulnerability can lead to a total loss of data integrity and availability. The CVSS score is 9.1, indicating high severity with network attack vector, no privileges or user interaction required. No patch or remediation information is currently available. There are no known exploits in the wild at this time.

CVE-2026-33614 is a high-severity SQL Injection vulnerability in the mbCONNECT24 product by MB connect line. It allows an unauthenticated remote attacker to exploit improper neutralization of special elements in the getinfo endpoint's SQL SELECT command. This vulnerability can lead to a total loss of confidentiality of the affected system's data. There is no information about an available patch or official remediation from the vendor. The vulnerability has a CVSS score of 7.5, indicating a significant risk if exploited.

CVE-2026-33613 is a high-severity remote code execution vulnerability in MB connect line's mbCONNECT24 product. It arises from improper neutralization of special elements in OS commands within the generateSrpArray function. Exploitation requires the attacker to have a prior capability to write arbitrary data to the user table. Successful exploitation could lead to full system compromise. There is no information about an available patch or vendor advisory. No known exploits are reported in the wild.

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.

An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.

A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession.

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession.

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.

A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.