CVE-2026-32968 PUBLISHED

Unauthenticated RCE in com_mb24sysapi

Assigner: CERTVDE
Reserved: 17.03.2026 Published: 23.03.2026 Updated: 23.03.2026

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor MB connect line
Product MB connect line mbCONNECT24
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)
Vendor MB connect line
Product mymbCONNECT24
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)
Vendor Helmholz
Product myREX24V2
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)
Vendor Helmholz
Product myREX24V2.virtual
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)

Credits

  • Moritz Abrell, Christian Zäske from SySS GmbH finder

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE