Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-32968

Unauthenticated RCE in com_mb24sysapi

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MB connect line MB connect line mbCONNECT24

Default version status: unaffected

  • 0.0.0 to ≤ 2.19.3affected

MB connect line mymbCONNECT24

Default version status: unaffected

  • 0.0.0 to ≤ 2.19.3affected

Helmholz myREX24V2

Default version status: unaffected

  • 0.0.0 to ≤ 2.19.3affected

Helmholz myREX24V2.virtual

Default version status: unaffected

  • 0.0.0 to ≤ 2.19.3affected

References