HIGH🇬🇧 English

CVE-2026-33613

CVSS 7.2v3.1pub. 2026-04-02upd. 2026-04-16

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Mbconnectline Mbconnect24

    APP
    Mbconnectline
    ≤ 2.19.4

  • Mbconnectline Mymbconnect24

    APP
    Mbconnectline
    ≤ 2.19.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Command Injection
CWE
Referencje

Powiązane podatności

CVE-2026-33615CRITICAL9.1PL ✓ten sam produkt

SQL Injection w endpoincie setinfo produktów Mbconnectline

CVE-2020-35565CRITICAL9.8PL ✓ten sam produkt

Brak domyślnej ochrony przed brute force w MB CONNECT LINE mymbCONNECT24

CVE-2020-10383CRITICAL9.8PL ✓ten sam produkt

RCE bez uwierzytelnienia w MB CONNECT LINE mymbCONNECT24 i mbCONNECT24

CVE-2026-33614HIGH7.5ten sam produkt

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo e...

CVE-2026-33616HIGH7.5ten sam produkt

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb2...