# CVE-2026-40851: MB connect line mbNET code execution in cfgparser via USB

Source: https://junglewise.ai/threats/cve-2026-40851-mb-connect-line-mbnet-code-execution-in-cfgparser-via-usb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-40851 · Severity: high · CVSS 8.4 · Published 2026-05-27

A vulnerability in MB connect line industrial routers allows an attacker with physical access to take full control of the device. By inserting a specially crafted USB stick, an attacker can exploit the configuration parser to execute unauthorized commands. This could lead to a complete compromise of the device, potentially disrupting industrial operations or exposing sensitive network data.

Vendors: [MB connect line](https://junglewise.ai/threats/vendors/mb-connect-line).

## Quick answers

**Is CVE-2026-40851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40851 being exploited in the wild.

**How severe is CVE-2026-40851?** High severity, with a CVSS score of 8.4, published 27 May 2026.

**Which products and versions are affected?** MB connect line mbNET <= 3.0.2; MB connect line mbNET.mini <= 3.0.2; MB connect line mbNET.rokey <= 8.4.4.

**Is there a fix for CVE-2026-40851?** A patch was published on 2026-05-27: Fixes released in firmware versions 8.4.5 and 3.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40851 attacked?** It is attacked with local access or with physical access, in device firmware.

**Am I affected by CVE-2026-40851?** Check whether you run MB connect line mbNET, MB connect line mbNET.mini or MB connect line mbNET.rokey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability (CWE-1287) exists in the 'cfgparser' component of MB connect line mbNET, mbNET.rokey, and mbNET.mini firmware. The issue stems from improper validation of input types when processing configuration files from external USB storage. A local attacker with physical access can trigger this vulnerability by inserting a USB stick containing a specially crafted file, leading to arbitrary code execution with high privileges. This results in a total loss of confidentiality, integrity, and availability. The vulnerability is addressed in mbNET/mbNET.rokey version 8.4.5 and mbNET.mini version 3.0.3.

## Affected products

- MB connect line mbNET.mini <= 3.0.2
- MB connect line mbNET/mbNET.rokey <= 8.4.4

## Timeline

- 2026-05-27: advisory: Initial advisory published by CERT@VDE
- 2026-05-27: patched: Fixes released in firmware versions 8.4.5 and 3.0.3

## References

- [https://www.certvde.com/en/advisories/VDE-2026-054/](https://www.certvde.com/en/advisories/VDE-2026-054/)

## Related threats

- [MB connect line mbNET OS command injection in config generator](https://junglewise.ai/threats/cve-2026-40852-mb-connect-line-mbnet-os-command-injection-in-config-generator)