CVE-2026-40851 — Command injection via USB

Description (CNA)

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

Affected (CNA)

Vendor / product	Versions
MB connect line / mbNET/mbNET.rokey	affected 0.0.0 through 8.4.4
MB connect line / mbNET.mini	affected 0.0.0 through 3.0.2
MB connect line / mbNET/mbNET.rokey	affected 8.4.4
MB connect line / mbNET.mini	affected 3.0.2
Helmholz / REX200/250	affected 0.0.0 through 8.4.4
Helmholz / REX100	affected 0.0.0 through 3.0.2
Helmholz / REX200/250	affected 8.4.4
Helmholz / REX100	affected 3.0.2

CWE

CWE-1287

References

https://www.certvde.com/en/advisories/VDE-2026-054/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.