CVE-2026-40851— Command injection via USB
Quick assessment
Affected
MB connect line mbNET/mbNET.rokey
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MB Connect Line mbNET和MB Connect Line mbNET.mini都是德国MB Connect Line公司的产品。MB Connect Line mbNET是一款工业路由器。MB Connect Line mbNET.mini是一款远程接入路由器。 MB Connect Line mbNET和MB Connect Line mbNET.mini存在安全漏洞，该漏洞源于本地攻击者可通过USB设备上的特制文件对cfgparser执行混淆攻击，可能导致代码执行，造成完全机密性、完
Possible ATT&CK Techniques 3 AI
T1044 T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Helmholz | REX100 | 0.0.0≤ 3.0.2 |
affected |
3.0.2 |
affected | ||
| Helmholz | REX200/250 | 0.0.0≤ 8.4.4 |
affected |
8.4.4 |
affected | ||
| MB connect line | mbNET.mini | 0.0.0≤ 3.0.2 |
affected |
3.0.2 |
affected | ||
| MB connect line | mbNET/mbNET.rokey | 0.0.0≤ 8.4.4 |
affected |
8.4.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40851
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Command injection via USB
Source: CVE Program / CVE List V5
Vulnerability Description
A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1287
Source: CVE Program / CVE List V5
Vulnerability Title
MB Connect Line mbNET和MB Connect Line mbNET.mini 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MB Connect Line mbNET和MB Connect Line mbNET.mini都是德国MB Connect Line公司的产品。MB Connect Line mbNET是一款工业路由器。MB Connect Line mbNET.mini是一款远程接入路由器。 MB Connect Line mbNET和MB Connect Line mbNET.mini存在安全漏洞，该漏洞源于本地攻击者可通过USB设备上的特制文件对cfgparser执行混淆攻击，可能导致代码执行，造成完全机密性、完
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MB connect line | mbNET/mbNET.rokey | 0.0.0 ~ 8.4.4 | - |
|
| MB connect line | mbNET.mini | 0.0.0 ~ 3.0.2 | - |
|
| MB connect line | mbNET/mbNET.rokey | 8.4.4 | - |
|
| MB connect line | mbNET.mini | 3.0.2 | - |
|
| Helmholz | REX200/250 | 0.0.0 ~ 8.4.4 | - |
|
| Helmholz | REX100 | 0.0.0 ~ 3.0.2 | - |
|
| Helmholz | REX200/250 | 8.4.4 | - |
|
| Helmholz | REX100 | 3.0.2 | - |
|
II. Public POCs for CVE-2026-40851
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40851
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-40851 (1)
Same Patch Batch · MB connect line · 2026-05-27 · 42 CVEs total
| CVE-2026-40810 | 7.5 HIGH | Unauthenticated SQLi in userinfo Endpoint |
| CVE-2026-40817 | 7.5 HIGH | Unauthenticated SQLi in getAlarmProfiles function |
| CVE-2026-40815 | 7.5 HIGH | Unauthenticated SQLi in _mb24api_getUserAccount function |
| CVE-2026-40819 | 7.5 HIGH | Unauthenticated SQLi in sync_data24 task |
| CVE-2026-40850 | 7.5 HIGH | Unauthenticated SQLi in getAccountData function |
| CVE-2026-40814 | 7.5 HIGH | Unauthenticated SQLi in _mb24confi_getTagAlarm function |
| CVE-2026-40818 | 7.5 HIGH | Unauthenticated SQLi in _mb24confi_getDevice function function |
| CVE-2026-40813 | 7.5 HIGH | Unauthenticated SQLi in getLiveValues |
| CVE-2026-40816 | 7.5 HIGH | Unauthenticated SQLi in _mb24confi_getTagAlarm function |
| CVE-2026-40811 | 7.5 HIGH | Unauthenticated SQLi in ssoabstractservice |
| CVE-2026-40812 | 7.5 HIGH | Unauthenticated SQLi in getLiveValues function |
| CVE-2026-40852 | 7.2 HIGH | Command injection via malicious configuration |
| CVE-2026-40833 | 7.1 HIGH | Authenticated SQLi in saveDashboardLayout function |
| CVE-2026-40836 | 7.1 HIGH | Authenticated SQLi in inmessage model |
| CVE-2026-40834 | 7.1 HIGH | Authenticated SQLi in saveDashboardLayout function |
| CVE-2026-40832 | 6.5 MEDIUM | Authenticated SQLi in getDevicegroups function |
| CVE-2026-40842 | 6.5 MEDIUM | Authenticated SQLi in getWidgetTags function |
| CVE-2026-40845 | 6.5 MEDIUM | Authenticated SQLi in devices_configuration view |
| CVE-2026-40844 | 6.5 MEDIUM | Authenticated SQLi in dashboard view |
| CVE-2026-40838 | 6.5 MEDIUM | Authenticated SQLi in getDeviceScalings function |
Showing top 20 of 42 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: MB connect line
-
CVE-2026-14448
Authenticated RCE in system_certificates view -
CVE-2026-10521
Authenticated unintended access to critical program paramete -
CVE-2026-40852
Command injection via malicious configuration -
CVE-2026-40850
Unauthenticated SQLi in getAccountData function -
CVE-2026-40849
Authenticated SQLi in user_alarmprofile view
Same weakness: CWE-1287
-
CVE-2026-75588
Mattermost Desktop App plugin popout scheme validation bypas -
CVE-2026-89207
WTV系列设备未验证输入致拒绝服务漏洞 -
CVE-2026-86287
Net::IP::LPM versions before 1.12 for Perl accept malformed -
CVE-2026-82741
Ash.Type.Union with :map_with_tag does not force the tag on -
CVE-2026-80051
graphql-go project graphql-go 软件供应链问题漏洞
V. Comments for CVE-2026-40851
No comments yet