CVE-2026-40810
Full vulnerability record from the local CVENow database.
Description
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-05-27 08:16:41.193000
Last modified
2026-10-26 12:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-40810",
"sourceIdentifier": "[email protected]",
"published": "2026-05-27T08:16:41.193",
"lastModified": "2026-10-26T12:10:00.130",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
},
{
"lang": "es",
"value": "Un atacante remoto no autenticado puede explotar una vulnerabilidad de inyección SQL no autenticada en el endpoint userinfo debido a la neutralización inadecuada de elementos especiales en un comando SQL SELECT. Esto puede resultar en una pérdida total de confidencialidad."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MB connect line",
"product": "mbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mymbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mymbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2.virtual",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2.virtual",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-27T11:53:13.201771Z",
"id": "CVE-2026-40810",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/",
"source": "[email protected]"
}
]
}