# cve.now: MB Connect Line

The newest entries naming MB Connect Line as an affected vendor (up to 200), of 95 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-60046](https://cve.now/CVE-2026-60046.md): DoS via password reset (CVSS 8.7)
- [CVE-2026-60045](https://cve.now/CVE-2026-60045.md): Arbitrary file upload (CVSS 6.9)
- [CVE-2026-60044](https://cve.now/CVE-2026-60044.md): Static backup password (CVSS 8.7)
- [CVE-2026-60043](https://cve.now/CVE-2026-60043.md): XSS in backend (CVSS 6.4)
- [CVE-2026-60042](https://cve.now/CVE-2026-60042.md): Authentication bypass in com\_check (CVSS 6.9)
- [CVE-2026-60041](https://cve.now/CVE-2026-60041.md): CSRF in backend (CVSS 5.3)
- [CVE-2026-60040](https://cve.now/CVE-2026-60040.md): DoS in backup creation (CVSS 8.7)
- [CVE-2026-60039](https://cve.now/CVE-2026-60039.md): Command injection in backup restore (CVSS 8.6)
- [CVE-2026-60038](https://cve.now/CVE-2026-60038.md): OpenSSL command injection in ImportPKCS12 (CVSS 8.6)
- [CVE-2026-60037](https://cve.now/CVE-2026-60037.md): OpenSSL command injection in device importer (CVSS 8.6)
- [CVE-2026-60036](https://cve.now/CVE-2026-60036.md): Command injection in patch activate (CVSS 8.6)
- [CVE-2026-60035](https://cve.now/CVE-2026-60035.md): Command injection in network auth (CVSS 8.6)
- [CVE-2026-14448](https://cve.now/CVE-2026-14448.md): Authenticated RCE in system\_certificates view (CVSS 8.6)
- [CVE-2026-10521](https://cve.now/CVE-2026-10521.md): Authenticated unintended access to critical program parameters (CVSS 8.6)
- [CVE-2026-40852](https://cve.now/CVE-2026-40852.md): Command injection via malicious configuration (CVSS 7.2)
- [CVE-2026-40851](https://cve.now/CVE-2026-40851.md): Command injection via USB (CVSS 8.4)
- [CVE-2026-40850](https://cve.now/CVE-2026-40850.md): Unauthenticated SQLi in getAccountData function (CVSS 8.7)
- [CVE-2026-40849](https://cve.now/CVE-2026-40849.md): Authenticated SQLi in user\_alarmprofile view (CVSS 7.1)
- [CVE-2026-40848](https://cve.now/CVE-2026-40848.md): Authenticated SQLi in tag view (CVSS 7.1)
- [CVE-2026-40847](https://cve.now/CVE-2026-40847.md): Authenticated SQLi in system\_tag view (CVSS 7.1)
- [CVE-2026-40846](https://cve.now/CVE-2026-40846.md): Authenticated SQLi in system view (CVSS 7.1)
- [CVE-2026-40845](https://cve.now/CVE-2026-40845.md): Authenticated SQLi in devices\_configuration view (CVSS 7.1)
- [CVE-2026-40844](https://cve.now/CVE-2026-40844.md): Authenticated SQLi in dashboard view (CVSS 7.1)
- [CVE-2026-40843](https://cve.now/CVE-2026-40843.md): Authenticated SQLi in alarming view (CVSS 7.1)
- [CVE-2026-40842](https://cve.now/CVE-2026-40842.md): Authenticated SQLi in getWidgetTags function (CVSS 7.1)
- [CVE-2026-40841](https://cve.now/CVE-2026-40841.md): Authenticated SQLi in getProjectTags function (CVSS 7.1)
- [CVE-2026-40840](https://cve.now/CVE-2026-40840.md): Authenticated SQLi in VerifyCreateLicences function (CVSS 7.1)
- [CVE-2026-40839](https://cve.now/CVE-2026-40839.md): Authenticated SQLi in getComponentScalings function (CVSS 7.1)
- [CVE-2026-40838](https://cve.now/CVE-2026-40838.md): Authenticated SQLi in getDeviceScalings function (CVSS 7.1)
- [CVE-2026-40837](https://cve.now/CVE-2026-40837.md): Authenticated SQLi in getProjectScalings function (CVSS 7.1)
- [CVE-2026-40836](https://cve.now/CVE-2026-40836.md): Authenticated SQLi in inmessage model (CVSS 7.1)
- [CVE-2026-40835](https://cve.now/CVE-2026-40835.md): Authenticated SQLi in saveObjectFromData function (CVSS 7.1)
- [CVE-2026-40834](https://cve.now/CVE-2026-40834.md): Authenticated SQLi in saveDashboardLayout function (CVSS 7.1)
- [CVE-2026-40833](https://cve.now/CVE-2026-40833.md): Authenticated SQLi in saveDashboardLayout function (CVSS 7.1)
- [CVE-2026-40832](https://cve.now/CVE-2026-40832.md): Authenticated SQLi in getDevicegroups function (CVSS 7.1)
- [CVE-2026-40831](https://cve.now/CVE-2026-40831.md): Authenticated SQLi in Easy View (CVSS 7.1)
- [CVE-2026-40830](https://cve.now/CVE-2026-40830.md): Authenticated SQLi in UpdateParam function (CVSS 7.0)
- [CVE-2026-40829](https://cve.now/CVE-2026-40829.md): Authenticated SQLi in UpdateParam function (CVSS 7.0)
- [CVE-2026-40828](https://cve.now/CVE-2026-40828.md): Authenticated SQLi in DeleteSysLogEntry function (CVSS 7.0)
- [CVE-2026-40827](https://cve.now/CVE-2026-40827.md): Authenticated SQLi in \_RemoveRequest function (CVSS 7.0)
- [CVE-2026-40826](https://cve.now/CVE-2026-40826.md): Authenticated SQLi in dsgvo\_contracts view (CVSS 6.9)
- [CVE-2026-40825](https://cve.now/CVE-2026-40825.md): Authenticated SQLi in accountstatus view (CVSS 7.0)
- [CVE-2026-40824](https://cve.now/CVE-2026-40824.md): Authenticated SQLi in accountstatus view (CVSS 7.0)
- [CVE-2026-40823](https://cve.now/CVE-2026-40823.md): Authenticated SQLi in DevSerialReset function (CVSS 7.0)
- [CVE-2026-40822](https://cve.now/CVE-2026-40822.md): Authenticated SQLi in DevSerialReset function (CVSS 6.9)
- [CVE-2026-40821](https://cve.now/CVE-2026-40821.md): Authenticated SQLi in getAccountByID function (CVSS 6.9)
- [CVE-2026-40819](https://cve.now/CVE-2026-40819.md): Unauthenticated SQLi in sync\_data24 task (CVSS 8.7)
- [CVE-2026-40818](https://cve.now/CVE-2026-40818.md): Unauthenticated SQLi in \_mb24confi\_getDevice function function (CVSS 8.7)
- [CVE-2026-40817](https://cve.now/CVE-2026-40817.md): Unauthenticated SQLi in getAlarmProfiles function (CVSS 8.7)
- [CVE-2026-40816](https://cve.now/CVE-2026-40816.md): Unauthenticated SQLi in \_mb24confi\_getTagAlarm function (CVSS 8.7)
- [CVE-2026-40815](https://cve.now/CVE-2026-40815.md): Unauthenticated SQLi in \_mb24api\_getUserAccount function (CVSS 8.7)
- [CVE-2026-40814](https://cve.now/CVE-2026-40814.md): Unauthenticated SQLi in \_mb24confi\_getTagAlarm function (CVSS 8.7)
- [CVE-2026-40813](https://cve.now/CVE-2026-40813.md): Unauthenticated SQLi in getLiveValues (CVSS 8.7)
- [CVE-2026-40812](https://cve.now/CVE-2026-40812.md): Unauthenticated SQLi in getLiveValues function (CVSS 8.7)
- [CVE-2026-40811](https://cve.now/CVE-2026-40811.md): Unauthenticated SQLi in ssoabstractservice (CVSS 8.7)
- [CVE-2026-40810](https://cve.now/CVE-2026-40810.md): Unauthenticated SQLi in userinfo Endpoint (CVSS 8.7)
- [CVE-2026-33617](https://cve.now/CVE-2026-33617.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint (CVSS 5.3)
- [CVE-2026-33616](https://cve.now/CVE-2026-33616.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint (CVSS 7.5)
- [CVE-2026-33615](https://cve.now/CVE-2026-33615.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint (CVSS 9.1)
- [CVE-2026-33614](https://cve.now/CVE-2026-33614.md): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint (CVSS 7.5)
- [CVE-2026-33613](https://cve.now/CVE-2026-33613.md): MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray (CVSS 7.2)
- [CVE-2026-32969](https://cve.now/CVE-2026-32969.md): Pre-Auth Blind SQLi in userinfo Endpoint (CVSS 7.5)
- [CVE-2026-32968](https://cve.now/CVE-2026-32968.md): Unauthenticated RCE in com\_mb24sysapi (CVSS 9.8)
- [CVE-2025-41688](https://cve.now/CVE-2025-41688.md): High Privilege RCE via LUA Sandbox Escape (CVSS 7.2)
- [CVE-2025-41681](https://cve.now/CVE-2025-41681.md): Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input (CVSS 4.8)
- [CVE-2025-41679](https://cve.now/CVE-2025-41679.md): Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service (CVSS 5.3)
- [CVE-2025-41678](https://cve.now/CVE-2025-41678.md): SQL Injection via POST Requests Allowing Configuration Database Manipulation (CVSS 6.5)
- [CVE-2025-41677](https://cve.now/CVE-2025-41677.md): Resource Exhaustion via POST Requests to send-mail Action (CVSS 4.9)
- [CVE-2025-41676](https://cve.now/CVE-2025-41676.md): Resource Exhaustion via POST Requests to send-sms Action (CVSS 4.9)
- [CVE-2025-41675](https://cve.now/CVE-2025-41675.md): Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization (CVSS 7.2)
- [CVE-2025-41674](https://cve.now/CVE-2025-41674.md): Remote Command Injection in diagnostic Action Due to Improper Input Neutralization (CVSS 7.2)
- [CVE-2025-41673](https://cve.now/CVE-2025-41673.md): Remote Command Injection in send\_sms Action Due to Improper Input Neutralization (CVSS 7.2)
- [CVE-2025-3092](https://cve.now/CVE-2025-3092.md): MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24 (CVSS 7.5)
- [CVE-2025-3091](https://cve.now/CVE-2025-3091.md): MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 (CVSS 7.5)
- [CVE-2025-3090](https://cve.now/CVE-2025-3090.md): MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24 (CVSS 8.2)
- [CVE-2024-23943](https://cve.now/CVE-2024-23943.md): MB connect line: Cloud API access due to a lack of authentication for a critical function (CVSS 9.1)
- [CVE-2024-23942](https://cve.now/CVE-2024-23942.md): MB connect line: Configuration File on the client workstation is not encrypted (CVSS 7.1)
- [CVE-2024-45276](https://cve.now/CVE-2024-45276.md): MB connect line/Helmholz: tmp directory exposed via webservice (CVSS 7.5)
- [CVE-2024-45275](https://cve.now/CVE-2024-45275.md): MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords (CVSS 9.8)
- [CVE-2024-45274](https://cve.now/CVE-2024-45274.md): MB connect line/Helmholz: Remote code execution via confnet service (CVSS 9.8)
- [CVE-2024-45273](https://cve.now/CVE-2024-45273.md): MB connect line/Helmholz: Weak encryption of configuration file (CVSS 8.4)
- [CVE-2024-45272](https://cve.now/CVE-2024-45272.md): MB connect line/Helmholz: Generation of weak passwords vulnerability (CVSS 7.5)
- [CVE-2024-45271](https://cve.now/CVE-2024-45271.md): MB connect line/Helmholz: Remote code execution due to improper input validation (CVSS 8.4)
- [CVE-2023-1779](https://cve.now/CVE-2023-1779.md): Helmholz and MB Connect Line: Account takeover via password reset in multiple products (CVSS 4.3)
- [CVE-2023-0985](https://cve.now/CVE-2023-0985.md): Helmholz and MB Connect Line: Account takeover via password reset in multiple products (CVSS 8.8)
- [CVE-2022-22520](https://cve.now/CVE-2022-22520.md): User enumeration vulnerability in MB connect line and Helmholz products (CVSS 5.3)
- [CVE-2021-34580](https://cve.now/CVE-2021-34580.md): Remote user enumeration in mymbCONNECT24, mbCONNECT24 \<= 2.9.0 (CVSS 7.5)
- [CVE-2021-34575](https://cve.now/CVE-2021-34575.md): Information Exposure in mymbCONNECT24, mbCONNECT24 \<= 2.8.0 (CVSS 7.5)
- [CVE-2021-34574](https://cve.now/CVE-2021-34574.md): Password policy evasion in products of MB connect line and Helmholz (CVSS 4.3)
- [CVE-2021-33527](https://cve.now/CVE-2021-33527.md): OS Command Injection in mbDIALUP \<= 3.9R0.0 (CVSS 9.8)
- [CVE-2021-33526](https://cve.now/CVE-2021-33526.md): Privilege escalation in mbDIALUP \<= 3.9R0.0 (CVSS 7.8)
- [CVE-2020-12530](https://cve.now/CVE-2020-12530.md): An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. (CVSS 4.3)
- [CVE-2020-12529](https://cve.now/CVE-2020-12529.md): An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP (CVSS 5.8)
- [CVE-2020-12528](https://cve.now/CVE-2020-12528.md): An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. (CVSS 6.5)
- [CVE-2020-12527](https://cve.now/CVE-2020-12527.md): Improper Access Validation in products of MB connect line and Helmholz (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mb-connect-line
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.