CVE-2026-40852highCWE-78

CVE-2026-40852: falha de alta gravidade em Helmholz REX100

Command injection via malicious configuration

Publicada em

Seguir esta CVE+ Monitorar mbNET.mini+ Monitorar REX100

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.4%
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Helmholz · REX100Helmholz · REX200/250MB connect line · mbNET/mbNET.rokeyMB connect line · mbNET.mini
CVEs relacionadas — Helmholz REX100

No mesmo produto, das mais perigosas para as menos.

CVE-2024-45274CRITICALMB connect line/Helmholz: Remote code execution via confnet serviceEPSS 1.5%CVE-2024-45275CRITICALMB connect line/Helmholz: Hardcoded user accounts with hard-coded passwordsEPSS 0.8%CVE-2025-41688HIGHHigh Privilege RCE via LUA Sandbox EscapeEPSS 0.8%CVE-2024-45276HIGHMB connect line/Helmholz: tmp directory exposed via webserviceEPSS 0.6%CVE-2024-45271HIGHMB connect line/Helmholz: Remote code execution due to improper input validationEPSS 0.3%CVE-2026-40851HIGHCommand injection via USBEPSS 0.1%