CVE-2026-33613

Received Received - Intake

Remote Code Execution in generateSrpArray via OS Command Injection

Publication date: 2026-04-02

Last updated on: 2026-04-16

Assigner: CERT VDE

Description

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-02

Last Modified

2026-04-16

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33613

EUVD

EUVD-2026-18173

Affected Vendors & Products

Vendor	Product	Version / Range
mbconnectline	mbconnect24	to 2.19.4 (inc)
mbconnectline	mymbconnect24	to 2.19.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability arises from improper neutralisation of special elements used in an operating system command within the generateSrpArray function.

A remote attacker who can write arbitrary data to the user table can exploit this flaw to execute remote code, potentially leading to full system compromise.

Impact Analysis

If exploited, this vulnerability allows a remote attacker to execute arbitrary code on the affected system.

This can result in full system compromise, including unauthorized access, data manipulation, and disruption of services.

Hi! I’m here to help you understand CVE-2026-33613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70