Hi Carsten,
SAP corrected a bug with 7.40.
BEx uses RFC. Insecure RFC port is 33xx, secure (SNC based) RFC port is 48xx. For a long time Bex used insecure port 33xx for SNC based RFC connection.
This was corrected but does not seem to be well documented.
So the correct solution is: Open port 48xx in your firewalls and add it to saprouttabs if necessary.
Regards,
Lutz