CVE-2026-40817
Full vulnerability record from the local CVENow database.
Description
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-05-27 08:16:42.203000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-40817",
"sourceIdentifier": "[email protected]",
"published": "2026-05-27T08:16:42.203",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
},
{
"lang": "es",
"value": "Un atacante remoto no autenticado puede explotar una vulnerabilidad de inyección SQL no autenticada en la función getAlarmProfiles debido a una neutralización inadecuada de elementos especiales en un comando SQL SELECT. Esto puede resultar en una pérdida total de confidencialidad."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MB connect line",
"product": "mbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mymbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mymbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2.virtual",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2.virtual",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-27T11:49:37.319078Z",
"id": "CVE-2026-40817",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/",
"source": "[email protected]"
}
]
}