CVE-2026-33617— MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33617
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint
Source: NVD (National Vulnerability Database)
Vulnerability Description
An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
将系统数据暴露到未授权控制的范围
Source: NVD (National Vulnerability Database)
Vulnerability Title
MB Connect Line mbCONNECT24 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MB Connect Line mbCONNECT24是德国MB Connect Line公司的一套远程服务门户网站。该产品支持远程接入、数据记录和报警等功能。 MB connect line mbCONNECT24存在安全漏洞，该漏洞源于可访问配置文件，可能导致数据库凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MB connect line | mbCONNECT24 | 0.0.0 ~ 2.19.4 | - | |
| MB connect line | mymbCONNECT24 | 0.0.0 ~ 2.19.4 | - |
II. Public POCs for CVE-2026-33617
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33617
请登录查看更多情报信息。
Same Patch Batch · MB connect line · 2026-04-02 · 5 CVEs total
| CVE-2026-33615 | 9.1 CRITICAL | MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo |
| CVE-2026-33616 | 7.5 HIGH | MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api |
| CVE-2026-33614 | 7.5 HIGH | MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo |
| CVE-2026-33613 | 7.2 HIGH | MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray |
IV. Related Vulnerabilities
Same product: mbCONNECT24
- CVE-2026-33616
MB connect line mbCONNECT24 vulnerable to an unauthenticated - CVE-2026-33615
MB connect line mbCONNECT24 vulnerable to an unauthenticated - CVE-2026-33614
MB connect line mbCONNECT24 vulnerable to an unauthenticated - CVE-2026-33613
MB connect line mbCONNECT24 vulnerable to RCE in generateSrp - CVE-2025-3091
MB connect line: Authorization bypass in mbCONNECT24/mymbCON
Same vendor: MB connect line
- CVE-2026-33616
MB connect line mbCONNECT24 vulnerable to an unauthenticated - CVE-2026-33615
MB connect line mbCONNECT24 vulnerable to an unauthenticated - CVE-2026-33614
MB connect line mbCONNECT24 vulnerable to an unauthenticated - CVE-2026-33613
MB connect line mbCONNECT24 vulnerable to RCE in generateSrp - CVE-2026-32969
Pre-Auth Blind SQLi in userinfo Endpoint
Same weakness: CWE-497
- CVE-2026-7864
Exposure of Sensitive Information to an Unauthorized Actor - CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-25468
WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sens - CVE-2026-42644
WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Expos - CVE-2026-24222
NVIDIA NeMoClaw 安全漏洞
V. Comments for CVE-2026-33617
No comments yet