CVE-2026-40835
Full vulnerability record from the local CVENow database.
Description
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-05-27 09:16:29.253000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-40835",
"sourceIdentifier": "[email protected]",
"published": "2026-05-27T09:16:29.253",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
},
{
"lang": "es",
"value": "Un atacante remoto de bajo privilegio puede explotar una vulnerabilidad de inyección SQL no autenticada en la función saveObjectFromData debido a una neutralización inadecuada de elementos especiales en un comando SQL SELECT. Esto puede resultar en una pérdida total de confidencialidad."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MB connect line",
"product": "mbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mymbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "MB connect line",
"product": "mymbCONNECT24",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2.virtual",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "2.20.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
},
{
"vendor": "Helmholz",
"product": "myREX24V2.virtual",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.20.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-27T11:52:23.859983Z",
"id": "CVE-2026-40835",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/",
"source": "[email protected]"
}
]
}