CVE-2026-32968: falha crítica em Helmholz myREX24V2
Unauthenticated RCE in com_mb24sysapi
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.6%
Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Helmholz · myREX24V2Helmholz · myREX24V2.virtualMB connect line · MB connect line mbCONNECT24MB connect line · mymbCONNECT24CVEs relacionadas — Helmholz myREX24V2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2026-32969HIGHPre-Auth Blind SQLi in userinfo EndpointEPSS 0.5%CVE-2026-40850HIGHUnauthenticated SQLi in getAccountData functionEPSS 0.4%CVE-2026-40831HIGHAuthenticated SQLi in Easy ViewEPSS 0.3%CVE-2026-40819HIGHUnauthenticated SQLi in sync_data24 taskEPSS 0.3%CVE-2026-40818HIGHUnauthenticated SQLi in _mb24confi_getDevice function functionEPSS 0.3%