Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
670 vulnerabilities
CVE-2026-14448 (GCVE-0-2026-14448)
Vulnerability from cvelistv5 – Published: 2026-07-20 11:40 – Updated: 2026-07-20 13:52
VLAI
EPSS
VEX
Title
Authenticated RCE in system_certificates view
Summary
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
1.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
1.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
1.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
1.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:52:15.023741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:52:32.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.\u003c/p\u003e"
}
],
"value": "An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T11:40:50.055Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
},
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-058/"
}
],
"source": {
"advisory": "VDE-2026-044, VDE-2026-058",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated RCE in system_certificates view",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-14448",
"datePublished": "2026-07-20T11:40:50.055Z",
"dateReserved": "2026-07-02T07:14:32.098Z",
"dateUpdated": "2026-07-20T13:52:32.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-49899 (GCVE-0-2023-49899)
Vulnerability from cvelistv5 – Published: 2026-07-16 10:11 – Updated: 2026-07-18 02:46
VLAI
EPSS
VEX
Title
Origin Validation Error in X-Rite MA-T6
Summary
An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://claroty.com/team82/disclosure-dashboard/c… | related |
Date Public
2023-12-23 10:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-49899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-18T02:45:55.345300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T02:46:07.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MA-T6",
"vendor": "X-Rite",
"versions": [
{
"lessThan": "v2.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:x-rite:ma-t6:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v2.33",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2023-12-23T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated remote attacker can\u0026nbsp;execute any command on the affected device due to not correctly verifying the origin of a communication channel."
}
],
"value": "An unauthenticated remote attacker can\u00a0execute any command on the affected device due to not correctly verifying the origin of a communication channel."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T10:11:32.404Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"related"
],
"url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-49899"
}
],
"source": {
"defect": [
"CERT@VDE#642027"
],
"discovery": "UNKNOWN"
},
"title": "Origin Validation Error in X-Rite MA-T6",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-49899",
"datePublished": "2026-07-16T10:11:32.404Z",
"dateReserved": "2023-12-01T08:19:11.319Z",
"dateUpdated": "2026-07-18T02:46:07.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-49900 (GCVE-0-2023-49900)
Vulnerability from cvelistv5 – Published: 2026-07-16 10:11 – Updated: 2026-07-16 15:11
VLAI
EPSS
VEX
Title
Origin Validation Error in X-Rite MA-T6
Summary
An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://claroty.com/team82/disclosure-dashboard/c… | related |
Date Public
2023-12-23 10:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-49900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T13:36:27.580238Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T15:11:14.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MA-T6",
"vendor": "X-Rite",
"versions": [
{
"lessThan": "v2.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:x-rite:ma-t6:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v2.33",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2023-12-23T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated remote attacker is able to perform remote code execution\u0026nbsp;due to incorrectly sanitized user input in the SetParameter command."
}
],
"value": "An unauthenticated remote attacker is able to perform remote code execution\u00a0due to incorrectly sanitized user input in the SetParameter command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T10:11:11.925Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"related"
],
"url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-49900"
}
],
"source": {
"defect": [
"CERT@VDE#642027"
],
"discovery": "UNKNOWN"
},
"title": "Origin Validation Error in X-Rite MA-T6",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-49900",
"datePublished": "2026-07-16T10:11:11.925Z",
"dateReserved": "2023-12-01T08:19:11.319Z",
"dateUpdated": "2026-07-16T15:11:14.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4769 (GCVE-0-2026-4769)
Vulnerability from cvelistv5 – Published: 2026-07-13 06:35 – Updated: 2026-07-13 14:44
VLAI
EPSS
VEX
Title
Unauthenticated Access to Internal Diagnostic Interface
Summary
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAGO | 0765-110x/0100-0000 |
Affected:
1.0.0.0 , < 1.2.1.100
(semver)
|
|
| WAGO | 0765-120x/0100-0000 |
Affected:
1.0.0.0 , < 1.2.7.100
(semver)
|
|
| WAGO | 0765-150x/0100-0000 |
Affected:
1.0.0.0 , < 1.2.7.103
(semver)
|
|
| WAGO | 0765-2101/0100-0000 |
Affected:
1.0.0.0 , < 1.2.1.102
(semver)
|
|
| WAGO | 0765-2102/0100-0000 |
Affected:
1.0.0.0 , < 1.2.5.101
(semver)
|
|
| WAGO | 0765-410x/0100-0000 |
Affected:
1.0.0.0 , < 1.2.1.100
(semver)
|
|
| WAGO | 0765-420x/0100-0000 |
Affected:
1.0.0.0 , < 1.2.7.100
(semver)
|
|
| WAGO | 0765-450x/0100-0000 |
Affected:
1.0.0.0 , < 1.2.7.103
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T14:44:35.455141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T14:44:48.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "0765-110x/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.1.100",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-120x/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.7.100",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-150x/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.7.103",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-2101/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.1.102",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-2102/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.5.101",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-410x/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.1.100",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-420x/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.7.100",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "0765-450x/0100-0000",
"vendor": "WAGO",
"versions": [
{
"lessThan": "1.2.7.103",
"status": "affected",
"version": "1.0.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.1.100",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:1.2.1.0:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.7.100",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:1.2.1.0:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.7.103",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:1.2.1.0:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.1.102",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:1.2.1.0:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.5.101",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.1.100",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:1.2.1.0:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.7.100",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wago:field_profinet:1.2.1.0:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.7.103",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCertain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.\u003c/p\u003e"
}
],
"value": "Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T06:35:01.116Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-031/"
}
],
"source": {
"advisory": "VDE-2026-031",
"defect": [
"CERT@VDE#641997"
],
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Access to Internal Diagnostic Interface",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-4769",
"datePublished": "2026-07-13T06:35:01.116Z",
"dateReserved": "2026-03-24T13:19:36.714Z",
"dateUpdated": "2026-07-13T14:44:48.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10521 (GCVE-0-2026-10521)
Vulnerability from cvelistv5 – Published: 2026-06-23 07:34 – Updated: 2026-06-23 12:28
VLAI
EPSS
VEX
Title
Authenticated unintended access to critical program parameters
Summary
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-425 - Direct Request ('Forced Browsing')
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , < 2.20.2
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , < 2.20.2
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.1
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10521",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T12:28:07.155466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T12:28:12.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThan": "2.20.2",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThan": "2.20.2",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.1"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.20.2",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.20.2",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.1:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.1:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.\u003c/p\u003e"
}
],
"value": "An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T07:34:10.089Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-068/"
}
],
"source": {
"advisory": "VDE-2026-068",
"defect": [
"CERT@VDE#642091"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated unintended access to critical program parameters",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-10521",
"datePublished": "2026-06-23T07:34:10.089Z",
"dateReserved": "2026-06-01T08:47:49.983Z",
"dateUpdated": "2026-06-23T12:28:12.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-45795 (GCVE-0-2023-45795)
Vulnerability from cvelistv5 – Published: 2026-06-22 09:06 – Updated: 2026-06-22 13:25
VLAI
EPSS
VEX
Title
Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx
Summary
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://certvde.com/en/advisories/VDE-2023-050/ | vendor-advisory |
Impacted products
Date Public
2025-06-03 06:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-45795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T13:25:28.450217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T13:25:46.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PMI v8xx",
"vendor": "Pilz",
"versions": [
{
"lessThanOrEqual": "2.0.33992",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PASvisu",
"vendor": "Pilz",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pilz:pmi_v8xx:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.33992",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pilz:pasvisu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.1",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2025-06-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T09:06:52.570Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://certvde.com/en/advisories/VDE-2023-050/"
}
],
"source": {
"advisory": "VDE-2023-050",
"defect": [
"CERT@VDE#64601"
],
"discovery": "UNKNOWN"
},
"title": "Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-45795",
"datePublished": "2026-06-22T09:06:52.570Z",
"dateReserved": "2023-10-13T06:40:49.611Z",
"dateUpdated": "2026-06-22T13:25:46.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-45796 (GCVE-0-2023-45796)
Vulnerability from cvelistv5 – Published: 2026-06-22 09:04 – Updated: 2026-06-22 15:39
VLAI
EPSS
VEX
Title
XSS vulnerability in Pilz PASvisu and PMI v8xx
Summary
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity and/or availability.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://certvde.com/en/advisories/VDE-2023-050/ | vendor-advisory |
Impacted products
Date Public
2025-06-03 06:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-45796",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T15:38:36.981971Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T15:39:26.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PMI v8xx",
"vendor": "Pilz",
"versions": [
{
"lessThanOrEqual": "2.0.33992",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PASvisu",
"vendor": "Pilz",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pilz:pmi_v8xx:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.33992",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pilz:pasvisu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.1",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2025-06-03T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity and/or availability.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity and/or availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T09:04:55.857Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://certvde.com/en/advisories/VDE-2023-050/"
}
],
"source": {
"advisory": "VDE-2023-050",
"defect": [
"CERT@VDE#64601"
],
"discovery": "UNKNOWN"
},
"title": "XSS vulnerability in Pilz PASvisu and PMI v8xx",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-45796",
"datePublished": "2026-06-22T09:04:55.857Z",
"dateReserved": "2023-10-13T06:40:49.611Z",
"dateUpdated": "2026-06-22T15:39:26.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8024 (GCVE-0-2026-8024)
Vulnerability from cvelistv5 – Published: 2026-06-18 09:43 – Updated: 2026-06-18 13:53
VLAI
EPSS
VEX
Title
Deserialization vulnerability in ibaPDA and ibaDatCoordinator
Summary
A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://iba.csaf-tp.certvde.com/.well-known/csaf/… | vendor-advisory |
| https://certvde.com/en/advisories/VDE-2026-051 | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| iba | ibaPDA |
Affected:
1.0.0 , < 8.14.0
(semver)
|
|
| iba | ibaDatCoordinator |
Affected:
1.0.0 , < 4.0.7
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8024",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T13:11:37.413154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T13:53:21.412Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ibaPDA",
"vendor": "iba",
"versions": [
{
"lessThan": "8.14.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ibaDatCoordinator",
"vendor": "iba",
"versions": [
{
"lessThan": "4.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iba:ibapda:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.14.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iba:ibadatcoordinator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.7",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Security Researchers from tenable"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems."
}
],
"value": "A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T09:45:34.902Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iba.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-051.json"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://certvde.com/en/advisories/VDE-2026-051"
}
],
"source": {
"advisory": "VDE-2026-051",
"defect": [
"CERT@VDE#642049"
],
"discovery": "UNKNOWN"
},
"title": "Deserialization vulnerability in ibaPDA and ibaDatCoordinator",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-8024",
"datePublished": "2026-06-18T09:43:14.712Z",
"dateReserved": "2026-05-06T06:31:06.618Z",
"dateUpdated": "2026-06-18T13:53:21.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5416 (GCVE-0-2026-5416)
Vulnerability from cvelistv5 – Published: 2026-06-16 08:18 – Updated: 2026-06-16 16:08
VLAI
EPSS
VEX
Title
Command Injection via name parameter
Summary
Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| TURCK | TBEN-LL-SE-M2 |
Affected:
0.0.0 , ≤ 2.0.6.0
(semver)
|
|
| TURCK | TBEN-L4-SE-M2 |
Affected:
0.0.0 , ≤ 2.0.6.0
(semver)
|
|
| TURCK | TBEN-L5-SE-M2 |
Affected:
0.0.0 , ≤ 2.0.6.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T16:07:08.304094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T16:08:44.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEN-LL-SE-M2",
"vendor": "TURCK",
"versions": [
{
"lessThanOrEqual": "2.0.6.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TBEN-L4-SE-M2",
"vendor": "TURCK",
"versions": [
{
"lessThanOrEqual": "2.0.6.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TBEN-L5-SE-M2",
"vendor": "TURCK",
"versions": [
{
"lessThanOrEqual": "2.0.6.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.\u003cbr\u003e"
}
],
"value": "Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T08:18:02.856Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2026-038"
}
],
"source": {
"advisory": "VDE-2026-038",
"defect": [
"CERT@VDE#642007"
],
"discovery": "UNKNOWN"
},
"title": "Command Injection via name parameter",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-5416",
"datePublished": "2026-06-16T08:18:02.856Z",
"dateReserved": "2026-04-02T10:13:27.443Z",
"dateUpdated": "2026-06-16T16:08:44.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41031 (GCVE-0-2026-41031)
Vulnerability from cvelistv5 – Published: 2026-06-09 09:51 – Updated: 2026-06-09 14:07
VLAI
EPSS
VEX
Title
A Stored Cross-Site Scripting (XSS) vulnerability occurs in Vinna Process Monitor
Summary
A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Skilja GmbH | Vinna Process Monitor |
Affected:
3.1.2 , < 4.0.6
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41031",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T14:04:34.847998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:07:12.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Vinna Process Monitor",
"vendor": "Skilja GmbH",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "3.1.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:skilja_gmbh:vinna_process_monitor:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.6",
"versionStartIncluding": "3.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Bartoszuk and Maciej W\u0142odarczyk @STM Cyber"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application.\u0026nbsp;This enables attackers to steal administrative access tokens and session credentials.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application.\u00a0This enables attackers to steal administrative access tokens and session credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T09:51:13.463Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://partner.skilja.com/uncategorized/security-advisory-stored-xss-in-vinna-process-monitor-cve-2026-41031/"
}
],
"source": {
"defect": [
"CERT@VDE#642084"
],
"discovery": "UNKNOWN"
},
"title": "A Stored Cross-Site Scripting (XSS) vulnerability occurs in Vinna Process Monitor",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-41031",
"datePublished": "2026-06-09T09:51:13.463Z",
"dateReserved": "2026-04-16T06:00:17.599Z",
"dateUpdated": "2026-06-09T14:07:12.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35085 (GCVE-0-2026-35085)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:42 – Updated: 2026-07-03 08:53
VLAI
EPSS
VEX
Title
Stack buffer overflow in method gdv-serverconfig
Summary
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35085",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:38:10.423532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:38:18.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.\u003c/p\u003e"
}
],
"value": "A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:53:29.811Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Stack buffer overflow in method gdv-serverconfig",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35085",
"datePublished": "2026-06-03T10:42:22.835Z",
"dateReserved": "2026-04-01T08:28:27.142Z",
"dateUpdated": "2026-07-03T08:53:29.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35084 (GCVE-0-2026-35084)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:42 – Updated: 2026-07-03 08:53
VLAI
EPSS
VEX
Title
Stack buffer overflow in method dali-devconfig
Summary
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T19:14:32.995589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T19:14:54.458Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.\u003c/p\u003e"
}
],
"value": "A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:53:13.982Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Stack buffer overflow in method dali-devconfig",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35084",
"datePublished": "2026-06-03T10:42:03.287Z",
"dateReserved": "2026-04-01T08:28:27.142Z",
"dateUpdated": "2026-07-03T08:53:13.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35083 (GCVE-0-2026-35083)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:41 – Updated: 2026-07-03 08:52
VLAI
EPSS
VEX
Title
Stack buffer overflow in method bac-deviceobject
Summary
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T13:13:32.326556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:07:23.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.\u003c/p\u003e"
}
],
"value": "A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:52:40.177Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Stack buffer overflow in method bac-deviceobject",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35083",
"datePublished": "2026-06-03T10:41:44.226Z",
"dateReserved": "2026-04-01T08:28:27.142Z",
"dateUpdated": "2026-07-03T08:52:40.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35082 (GCVE-0-2026-35082)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:41 – Updated: 2026-07-03 08:52
VLAI
EPSS
VEX
Title
Local file inclusion vulnerability and deletion in ugw-logread method
Summary
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:17:16.483140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:17:26.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input. \u003c/p\u003e"
}
],
"value": "The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:52:21.717Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Local file inclusion vulnerability and deletion in ugw-logread method",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35082",
"datePublished": "2026-06-03T10:41:00.660Z",
"dateReserved": "2026-04-01T08:28:27.142Z",
"dateUpdated": "2026-07-03T08:52:21.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35081 (GCVE-0-2026-35081)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:40 – Updated: 2026-07-03 08:51
VLAI
EPSS
VEX
Title
Arbitrary process termination vulnerability in method ugw-logstop
Summary
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35081",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:43:08.950874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:43:15.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.\u003c/p\u003e"
}
],
"value": "The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:51:59.819Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary process termination vulnerability in method ugw-logstop",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35081",
"datePublished": "2026-06-03T10:40:44.560Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:51:59.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35080 (GCVE-0-2026-35080)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:40 – Updated: 2026-07-03 08:51
VLAI
EPSS
VEX
Title
Arbitrary file delete vulnerability in method ugw-restoreinfo
Summary
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:32:48.333684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:34:20.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.\u003c/p\u003e"
}
],
"value": "The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:51:44.993Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary file delete vulnerability in method ugw-restoreinfo",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35080",
"datePublished": "2026-06-03T10:40:25.172Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:51:44.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35079 (GCVE-0-2026-35079)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:39 – Updated: 2026-07-03 08:51
VLAI
EPSS
VEX
Title
Arbitrary file delete vulnerability in method ugw-restore
Summary
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:38:56.295555Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:39:03.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.\u003c/p\u003e"
}
],
"value": "The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:51:26.663Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary file delete vulnerability in method ugw-restore",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35079",
"datePublished": "2026-06-03T10:39:51.326Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:51:26.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35078 (GCVE-0-2026-35078)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:39 – Updated: 2026-07-03 08:51
VLAI
EPSS
VEX
Title
Arbitrary file delete vulnerability in method ugw-logstop
Summary
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T13:13:48.270847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:07:29.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.\u003c/p\u003e"
}
],
"value": "The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:51:10.458Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary file delete vulnerability in method ugw-logstop",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35078",
"datePublished": "2026-06-03T10:39:33.498Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:51:10.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35077 (GCVE-0-2026-35077)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:39 – Updated: 2026-07-03 08:50
VLAI
EPSS
VEX
Title
Arbitrary file delete vulnerability in method ugw-delete-file
Summary
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35077",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T14:16:16.677133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:16:50.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.\u003c/p\u003e"
}
],
"value": "The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:50:46.714Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary file delete vulnerability in method ugw-delete-file",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35077",
"datePublished": "2026-06-03T10:39:12.567Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:50:46.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35076 (GCVE-0-2026-35076)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:38 – Updated: 2026-07-03 08:50
VLAI
EPSS
VEX
Title
Arbitrary file delete vulnerability in method bac-scanresult
Summary
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35076",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:43:26.903435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:43:33.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.\u003c/p\u003e"
}
],
"value": "The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:50:25.377Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary file delete vulnerability in method bac-scanresult",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35076",
"datePublished": "2026-06-03T10:38:49.975Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:50:25.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35075 (GCVE-0-2026-35075)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:38 – Updated: 2026-07-03 08:49
VLAI
EPSS
VEX
Title
Hardcoded default Password for Service Account
Summary
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1393 - Use of Default Password
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A Profibus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-A x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Single-X |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X CAN |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Double-X x-link |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_00_00 , < V6_00_07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:39:57.652546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:41:59.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_00_07",
"status": "affected",
"version": "V1_00_00",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_00_07",
"versionStartIncluding": "V1_00_00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter from Armasuisse Cyber-Defence campus."
},
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber Defense Campus Zurich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices. \u003c/p\u003e"
}
],
"value": "An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393 Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T08:49:03.078Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Hardcoded default Password for Service Account",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35075",
"datePublished": "2026-06-03T10:38:23.515Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-07-03T08:49:03.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41032 (GCVE-0-2026-41032)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:16 – Updated: 2026-06-03 12:39
VLAI
EPSS
VEX
Title
Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers
Summary
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://phoenixcontact.csaf-tp.certvde.com/.well-… | vendor-advisory |
| https://certvde.com/de/advisories/VDE-2026-060/ | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | CHARX SEC-3150 |
Affected:
1.0.0 , < 1.9.0
(custom)
|
|
| Phoenix Contact | CHARX SEC-3100 |
Affected:
1.0.0 , < 1.9.0
(custom)
|
|
| Phoenix Contact | CHARX SEC-3050 |
Affected:
1.0.0 , < 1.9.0
(custom)
|
|
| Phoenix Contact | CHARX SEC-3000 |
Affected:
1.0.0 , < 1.9.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41032",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:39:30.651560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:39:40.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CHARX SEC-3150",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "1.9.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CHARX SEC-3100",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "1.9.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CHARX SEC-3050",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "1.9.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CHARX SEC-3000",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "1.9.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:phoenix_contact:charx_sec-3150_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:phoenix_contact:charx_sec-3100_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:phoenix_contact:charx_sec-3050_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:phoenix_contact:charx_sec-3000_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Piotr Ptaszek, Mateusz W\u00f3jcik from ZDI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information."
}
],
"value": "It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T10:16:16.992Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-060.json"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://certvde.com/de/advisories/VDE-2026-060/"
}
],
"source": {
"advisory": "VDE-2026-060",
"defect": [
"CERT@VDE#642036"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-41032",
"datePublished": "2026-06-03T10:16:16.992Z",
"dateReserved": "2026-04-16T06:00:17.600Z",
"dateUpdated": "2026-06-03T12:39:40.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40852 (GCVE-0-2026-40852)
Vulnerability from cvelistv5 – Published: 2026-05-27 08:06 – Updated: 2026-05-27 11:54
VLAI
EPSS
VEX
Title
Command injection via malicious configuration
Summary
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbNET/mbNET.rokey |
Affected:
0.0.0 , ≤ 8.4.4
(semver)
|
|
| MB connect line | mbNET.mini |
Affected:
0.0.0 , ≤ 3.0.2
(semver)
|
|
| MB connect line | mbNET/mbNET.rokey |
Affected:
8.4.4
|
|
| MB connect line | mbNET.mini |
Affected:
3.0.2
|
|
| Helmholz | REX200/250 |
Affected:
0.0.0 , ≤ 8.4.4
(semver)
|
|
| Helmholz | REX100 |
Affected:
0.0.0 , ≤ 3.0.2
(semver)
|
|
| Helmholz | REX200/250 |
Affected:
8.4.4
|
|
| Helmholz | REX100 |
Affected:
3.0.2
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:44:33.329985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:54:17.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbNET/mbNET.rokey",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "8.4.4",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbNET.mini",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbNET/mbNET.rokey",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "8.4.4"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbNET.mini",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "3.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX200/250",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "8.4.4",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX100",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX200/250",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "8.4.4"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX100",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "3.0.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbnet_mbnet.rokey:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.4.4",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.2",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbnet:8.4.4:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbnet.mini:3.0.2:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:rex200_250:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.4.4",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:rex100:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.2",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:rex200_250:8.4.4:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:rex100:3.0.2:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Moritz Abrell from SySS GmbH"
},
{
"lang": "en",
"type": "finder",
"value": "Christian Z\u00e4ske from SySS GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.\u003c/p\u003e"
}
],
"value": "A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T08:06:36.875Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-054/"
}
],
"source": {
"advisory": "VDE-2026-054",
"defect": [
"CERT@VDE#642070"
],
"discovery": "UNKNOWN"
},
"title": "Command injection via malicious configuration",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40852",
"datePublished": "2026-05-27T08:06:36.875Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:54:17.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40851 (GCVE-0-2026-40851)
Vulnerability from cvelistv5 – Published: 2026-05-27 08:06 – Updated: 2026-05-27 11:54
VLAI
EPSS
VEX
Title
Command injection via USB
Summary
A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbNET/mbNET.rokey |
Affected:
0.0.0 , ≤ 8.4.4
(semver)
|
|
| MB connect line | mbNET.mini |
Affected:
0.0.0 , ≤ 3.0.2
(semver)
|
|
| MB connect line | mbNET/mbNET.rokey |
Affected:
8.4.4
|
|
| MB connect line | mbNET.mini |
Affected:
3.0.2
|
|
| Helmholz | REX200/250 |
Affected:
0.0.0 , ≤ 8.4.4
(semver)
|
|
| Helmholz | REX100 |
Affected:
0.0.0 , ≤ 3.0.2
(semver)
|
|
| Helmholz | REX200/250 |
Affected:
8.4.4
|
|
| Helmholz | REX100 |
Affected:
3.0.2
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:44:44.253548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:54:33.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbNET/mbNET.rokey",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "8.4.4",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbNET.mini",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbNET/mbNET.rokey",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "8.4.4"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbNET.mini",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "3.0.2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX200/250",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "8.4.4",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX100",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX200/250",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "8.4.4"
}
]
},
{
"defaultStatus": "unaffected",
"product": "REX100",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "3.0.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbnet_mbnet.rokey:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.4.4",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.2",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbnet:8.4.4:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbnet.mini:3.0.2:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:rex200_250:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.4.4",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:rex100:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.2",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:rex200_250:8.4.4:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:rex100:3.0.2:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Moritz Abrell from SySS GmbH"
},
{
"lang": "en",
"type": "finder",
"value": "Christian Z\u00e4ske from SySS GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.\u003c/p\u003e"
}
],
"value": "A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "CWE-1287 Improper Validation of Specified Type of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T08:06:21.815Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-054/"
}
],
"source": {
"advisory": "VDE-2026-054",
"defect": [
"CERT@VDE#642070"
],
"discovery": "UNKNOWN"
},
"title": "Command injection via USB",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40851",
"datePublished": "2026-05-27T08:06:21.815Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:54:33.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40850 (GCVE-0-2026-40850)
Vulnerability from cvelistv5 – Published: 2026-05-27 08:00 – Updated: 2026-05-27 11:54
VLAI
EPSS
VEX
Title
Unauthenticated SQLi in getAccountData function
Summary
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:45:14.341304Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:54:47.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.\u003c/p\u003e"
}
],
"value": "An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T08:00:11.447Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
}
],
"source": {
"advisory": "VDE-2026-044",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Unauthenticated SQLi in getAccountData function",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40850",
"datePublished": "2026-05-27T08:00:01.201Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:54:47.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40849 (GCVE-0-2026-40849)
Vulnerability from cvelistv5 – Published: 2026-05-27 07:59 – Updated: 2026-05-27 11:55
VLAI
EPSS
VEX
Title
Authenticated SQLi in user_alarmprofile view
Summary
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40849",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:45:37.670919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:55:01.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.\u003c/p\u003e"
}
],
"value": "An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T07:59:44.789Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
}
],
"source": {
"advisory": "VDE-2026-044",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated SQLi in user_alarmprofile view",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40849",
"datePublished": "2026-05-27T07:59:44.789Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:55:01.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40848 (GCVE-0-2026-40848)
Vulnerability from cvelistv5 – Published: 2026-05-27 07:59 – Updated: 2026-05-27 11:55
VLAI
EPSS
VEX
Title
Authenticated SQLi in tag view
Summary
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40848",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:45:48.129044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:55:15.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.\u003c/p\u003e"
}
],
"value": "An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T07:59:29.242Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
}
],
"source": {
"advisory": "VDE-2026-044",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated SQLi in tag view",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40848",
"datePublished": "2026-05-27T07:59:29.242Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:55:15.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40847 (GCVE-0-2026-40847)
Vulnerability from cvelistv5 – Published: 2026-05-27 07:59 – Updated: 2026-05-27 11:55
VLAI
EPSS
VEX
Title
Authenticated SQLi in system_tag view
Summary
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40847",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:45:57.385253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:55:30.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.\u003c/p\u003e"
}
],
"value": "An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T07:59:14.019Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
}
],
"source": {
"advisory": "VDE-2026-044",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated SQLi in system_tag view",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40847",
"datePublished": "2026-05-27T07:59:14.019Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:55:30.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40846 (GCVE-0-2026-40846)
Vulnerability from cvelistv5 – Published: 2026-05-27 07:58 – Updated: 2026-05-27 11:55
VLAI
EPSS
VEX
Title
Authenticated SQLi in system view
Summary
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:46:09.029180Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:55:44.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.\u003c/p\u003e"
}
],
"value": "An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T07:58:59.970Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
}
],
"source": {
"advisory": "VDE-2026-044",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated SQLi in system view",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40846",
"datePublished": "2026-05-27T07:58:59.970Z",
"dateReserved": "2026-04-15T09:33:02.614Z",
"dateUpdated": "2026-05-27T11:55:44.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40845 (GCVE-0-2026-40845)
Vulnerability from cvelistv5 – Published: 2026-05-27 07:58 – Updated: 2026-05-27 11:55
VLAI
EPSS
VEX
Title
Authenticated SQLi in devices_configuration view
Summary
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MB connect line | mbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mymbCONNECT24 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| MB connect line | mbCONNECT24 |
Affected:
2.20.0
|
|
| MB connect line | mymbCONNECT24 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2 |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2.virtual |
Affected:
0.0.0 , ≤ 2.20.0
(semver)
|
|
| Helmholz | myREX24V2 |
Affected:
2.20.0
|
|
| Helmholz | myREX24V2.virtual |
Affected:
2.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40845",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T11:46:26.323992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T11:55:57.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mymbCONNECT24",
"vendor": "MB connect line",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "myREX24V2.virtual",
"vendor": "Helmholz",
"versions": [
{
"status": "affected",
"version": "2.20.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:*",
"versionStartIncluding": "2.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.\u003c/p\u003e"
}
],
"value": "An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T07:58:44.537Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-044/"
}
],
"source": {
"advisory": "VDE-2026-044",
"defect": [
"CERT@VDE#642025"
],
"discovery": "UNKNOWN"
},
"title": "Authenticated SQLi in devices_configuration view",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-40845",
"datePublished": "2026-05-27T07:58:44.537Z",
"dateReserved": "2026-04-15T09:33:02.613Z",
"dateUpdated": "2026-05-27T11:55:57.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}