CVE-2026-40852

HIGH

MB connect line mbNET/mbNET.rokey - Command Injection via Malicious Configuration

Title source: rule
STIX 2.1

Description

A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

References (1)

Core 1

Scores

CVSS v3 7.2
EPSS 0.0040
EPSS Percentile 31.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (8)
Helmholz/REX100 0.0.0 - 3.0.2
Helmholz/REX100 3.0.2
Helmholz/REX200/250 0.0.0 - 8.4.4
Helmholz/REX200/250 8.4.4
MB connect line/mbNET.mini 0.0.0 - 3.0.2
MB connect line/mbNET.mini 3.0.2
MB connect line/mbNET/mbNET.rokey 0.0.0 - 8.4.4
MB connect line/mbNET/mbNET.rokey 8.4.4
Published May 27, 2026
Tracked Since May 27, 2026