Configuration File Exposure in VDE Products by CERTVDE
CVE-2026-33617

5.3MEDIUM

Key Information:

Vendor

Mb Connect Line

Status
Mbconnect24
Mymbconnect24
Vendor
CVE Published:
2 April 2026

What is CVE-2026-33617?

An unauthenticated remote attacker has the ability to access a configuration file that holds sensitive database credentials. Although this vulnerability presents a potential risk to confidentiality, it does not provide a direct endpoint for exploiting these credentials.

Affected Version(s)

mbCONNECT24 0.0.0 <= 2.19.4

mymbCONNECT24 0.0.0 <= 2.19.4

References

https://certvde.com/de/advisories/VDE-2026-030
vendor-advisory
https://mbconnectline.csaf-tp.certvde.com/.well-known/csa...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Moritz Abrell, Christian Zäske from SySS GmbH
.