CVE-2026-32969: falha de alta gravidade em Helmholz myREX24V2
Pre-Auth Blind SQLi in userinfo Endpoint
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Helmholz · myREX24V2Helmholz · myREX24V2.virtualMB connect line · MB connect line mbCONNECT24MB connect line · mymbCONNECT24CVEs relacionadas — Helmholz myREX24V2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2026-32968CRITICALUnauthenticated RCE in com_mb24sysapiEPSS 0.6%CVE-2026-40850HIGHUnauthenticated SQLi in getAccountData functionEPSS 0.4%CVE-2026-40831HIGHAuthenticated SQLi in Easy ViewEPSS 0.3%CVE-2026-40819HIGHUnauthenticated SQLi in sync_data24 taskEPSS 0.3%CVE-2026-40818HIGHUnauthenticated SQLi in _mb24confi_getDevice function functionEPSS 0.3%