CVE-2026-33613
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
68/100
Published: 2026-04-02
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| mbconnectline | mbconnect24 | < 2.19.4 |
| mbconnectline | mymbconnect24 | < 2.19.4 |
References & Advisories (2)
Vendor Advisory
Third Party Advisory