PT-2026-29712 · Mb Connect Line · Mbconnect24

Christian Zäske + 1 · CVE-2026-33615 · Published 2026-04-02 · Updated 2026-04-03

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MB connect line mbCONNECT24 (affected versions not specified)

Description An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33615

Affected Products

Mbconnect24

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-33615 · Security Note
• https://certvde.com/de/advisories/VDE-2026-030 · Vendor Advisory
• https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json · Vendor Advisory
• https://twitter.com/CveFindCom/status/2039678167087018399 · Twitter Post
• https://twitter.com/CVEnew/status/2039647681812054233 · Twitter Post
• https://twitter.com/CosmicBytez/status/2039994907696496954 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039635043262341210 · Twitter Post