HIGH🇬🇧 English

CVE-2026-33613

CVSS 7.2v3.1pub. 2026-04-02upd. 2026-04-16

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Mbconnectline Mbconnect24

    APP
    Mbconnectline
    ≤ 2.19.4

  • Mbconnectline Mymbconnect24

    APP
    Mbconnectline
    ≤ 2.19.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Command Injection
CWE
Referencje

Powiązane podatności

CVE-2026-33615CRITICAL9.1PL ✓ten sam produkt

SQL Injection w endpoincie setinfo produktów Mbconnectline

CVE-2020-35565CRITICAL9.8ten sam produkt

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages brutef...

CVE-2020-10383CRITICAL9.8ten sam produkt

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through ...

CVE-2026-33614HIGH7.5ten sam produkt

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo e...

CVE-2026-33616HIGH7.5ten sam produkt

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb2...