Vendor
Mb Connect Line
83 known vulnerabilities in products by Mb Connect Line, 0 of them actively exploited (CISA KEV).
Key figures
83
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-33527 | OS Command Injection in mbDIALUP <= 3.9R0.0 | 9.8 | |
| Critical | CVE-2024-45274 | MB connect line/Helmholz: Remote code execution via confnet service | 9.8 | |
| High | CVE-2026-14448 | Authenticated RCE in system_certificates view | 7.2 | |
| Critical | CVE-2026-32968 | Unauthenticated RCE in com_mb24sysapi | 9.8 | |
| Critical | CVE-2024-45275 | MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords | 9.8 | |
| High | CVE-2026-10521 | Authenticated unintended access to critical program parameters | 7.2 | |
| High | CVE-2026-33613 | MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray | 8.8 | |
| High | CVE-2023-0985 | Helmholz and MB Connect Line: Account takeover via password reset in multiple products | 8.8 | |
| Critical | CVE-2024-23943 | MB connect line: Cloud API access due to a lack of authentication for a critical function | 9.1 | |
| Critical | CVE-2026-33615 | MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint | 9.1 | |
| High | CVE-2025-41688 | High Privilege RCE via LUA Sandbox Escape | 7.2 | |
| High | CVE-2021-34580 | Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0 | 7.5 | |
| High | CVE-2026-40850 | Unauthenticated SQLi in getAccountData function | 7.5 | |
| High | CVE-2021-34575 | Information Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0 | 7.5 | |
| High | CVE-2025-41675 | MB connect line mbNET.mini: OS Command Injection | 7.2 | |
| High | CVE-2025-41674 | Remote Command Injection in diagnostic Action Due to Improper Input Neutralization | 7.2 | |
| High | CVE-2025-41673 | Remote Command Injection in send_sms Action Due to Improper Input Neutralization | 7.2 | |
| High | CVE-2026-40817 | Unauthenticated SQLi in getAlarmProfiles function | 7.5 | |
| High | CVE-2026-40815 | Unauthenticated SQLi in _mb24api_getUserAccount function | 7.5 | |
| High | CVE-2026-40819 | Unauthenticated SQLi in sync_data24 task | 7.5 | |
| High | CVE-2026-40818 | Unauthenticated SQLi in _mb24confi_getDevice function function | 7.5 | |
| High | CVE-2026-40816 | Unauthenticated SQLi in _mb24confi_getTagAlarm function | 7.5 | |
| High | CVE-2026-40814 | Unauthenticated SQLi in _mb24confi_getTagAlarm function | 7.5 | |
| High | CVE-2026-40813 | Unauthenticated SQLi in getLiveValues | 7.5 | |
| High | CVE-2026-40812 | Unauthenticated SQLi in getLiveValues function | 7.5 |
Products
| Mymbconnect24 | 66 | 0 |
| Mbconnect24 | 64 | 0 |
| Mbnet.mini | 15 | 0 |
| Mbnet/mbnet.rokey | 4 | 0 |