SQL Injection Flaw in VPN Data Retrieval Function for CERTVDE Products
CVE-2026-40820

6.9MEDIUM

Key Information:

Vendor: Mb Connect Line
Status: Mbconnect24; Mymbconnect24; Myrex24v2; Myrex24v2.virtual
Vendor: CVE Published:; 12 November 2026

🔔 Create Mb Connect Line Vulnerability Alert

What is CVE-2026-40820?

A vulnerability has been identified where a remote attacker with high privileges can exploit an unauthenticated SQL Injection flaw in the getVpnData function. This is due to inadequate handling of special elements within a SQL SELECT command. Successful exploitation could lead to severe compromises in confidentiality, allowing unauthorized access to sensitive data.

Affected Version(s)

mbCONNECT24 1.0.0 <= 2.20.0

mbCONNECT24 2.20.0

mymbCONNECT24 1.0.0 <= 2.20.0

References

https://www.certvde.com/en/advisories/VDE-2026-044/

https://www.certvde.com/en/advisories/VDE-2026-058/

CVSS V4

Score:

6.9

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 12, 2026
Vulnerability Reserved
Apr 15, 2026

CVE-2026-40820 Data

JSON