Zurück zur Übersicht

MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1

VDE-2020-035
Last update
14.05.2025 14:28
Published at
18.09.2020 14:30
Vendor(s)
MB connect line GmbH
External ID
VDE-2020-035
CSAF Document
Download

Summary

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

Impact

Please consult the above CVEs for details.

Affected Product(s)

Model no. Product name Affected versions
mbCONNECT24 <=2.6.1
mymbCONNECT24 <=2.6.1

Vulnerabilities

Expand / Collapse all

Published
25.08.2026 10:58
Vulnerability characterization
6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
Weakness
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information.

References
cve.org | nvd.nist.gov

Published
25.08.2026 10:58
Vulnerability characterization
6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
Weakness
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.1. There is a SSRF and CSRF issue, in the com_mb24proxy module, allowing attackers to steal session information from logged in users with a specifically crafted link.

References
cve.org | nvd.nist.gov

Published
25.08.2026 10:58
Vulnerability characterization
4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
Weakness
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information.

References
cve.org | nvd.nist.gov

Remediation

Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1

Acknowledgments

MB connect line GmbH thanks the following parties for their efforts:

  • Sharon Brizinov, Tal Keren from OTORIO for reported
  • CERT@VDE for coordination

Revision History

Version Date Summary
1 18.09.2020 14:30 Initial revision.
2 06.11.2024 12:27 Fix: added self-reference
3 12.02.2025 17:48 Fix: corrected self-reference, fixed version
4 14.05.2025 14:28 Fix: removed ia, added distribution