CVE-2026-40851: Command injection via USB

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-10-26
Weakness: CWE-1287

Description

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

Affected products

Helmholz REX100: through 3.0.2; 3.0.2
Helmholz REX200/250: through 8.4.4; 8.4.4
MB connect line mbNET.mini: through 3.0.2; 3.0.2
MB connect line mbNET/mbNET.rokey: through 8.4.4; 8.4.4

References

https://www.certvde.com/en/advisories/VDE-2026-054/

Get alerted when CVE-2026-40851 or the next vulnerability affects your stack