CVSS: 8.4EPSS: 0%CPEs: 11EXPL: 0CVE-2024-45273 – MB connect line/Helmholz: Weak encryption of configuration file
https://notcve.org/view.php?id=CVE-2024-45273
15 Oct 2024 — An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. Un atacante local no autenticado puede descifrar el archivo de configuración del dispositivo y, por lo tanto, comprometer el dispositivo debido a una implementación débil del cifrado utilizado. • https://cert.vde.com/en/advisories/VDE-2024-056 • CWE-261: Weak Encoding for Password •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-45272 – MB connect line/Helmholz: Generation of weak passwords vulnerability
https://notcve.org/view.php?id=CVE-2024-45272
15 Oct 2024 — An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. Un atacante remoto no autenticado puede realizar un ataque de fuerza bruta a las credenciales del portal de servicio remoto con una alta probabilidad de éxito, lo que da como resultado la pérdida de la conexión. • https://cert.vde.com/en/advisories/VDE-2024-068 • CWE-1391: Use of Weak Credentials •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4834
https://notcve.org/view.php?id=CVE-2023-4834
16 Oct 2023 — In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to. En Red Lion Europe mbCONNECT24 y mymbCONNECT24 y Helmholz myREX24 y myREX24.virtual hasta la versión 2.14.2 incluida, una validación de acceso implementada incorrectamente permite a un atacante... • https://cert.vde.com/en/advisories/VDE-2023-041 • CWE-269: Improper Privilege Management •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-22520 – User enumeration vulnerability in MB connect line and Helmholz products
https://notcve.org/view.php?id=CVE-2022-22520
14 Sep 2022 — A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Un atacante remoto no autenticado puede enumerar usuarios válidos mediante el envío de peticiones específicas al webservice de la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta v2.11.2 • https://cert.vde.com/en/advisories/VDE-2022-011 • CWE-204: Observable Response Discrepancy •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-34574 – Password policy evasion in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2021-34574
02 Aug 2021 — In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server. En MB connect line mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2 un atacante autenticado puede cambiar la contraseña de su cuenta por una nueva qu... • https://cert.vde.com/en/advisories/VDE-2021-030 • CWE-669: Incorrect Resource Transfer Between Spheres •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-12527 – Improper Access Validation in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-12527
02 Mar 2021 — An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corresponding permissions. Se ha descubierto un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Una validación de acceso inadecuada permite a un usuario conectado a... • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-269: Improper Privilege Management •
CVSS: 5.3EPSS: 1%CPEs: 4EXPL: 0CVE-2020-35561 – SSRF in variuos products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35561
16 Feb 2021 — An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports. Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Existe un SSRF en el módulo HA que permite a un atacante no autentificado escanear puertos abiertos. • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35568 – Sensitive Information Exposure in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35568
16 Feb 2021 — An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account. Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Un filtro incompleto aplicado a una respuesta de la... • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35566 – Local file inclusion vulnerability in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35566
16 Feb 2021 — An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion. Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Un atacante puede leer archivos JSON arbitrarios a través de la inclusión de archivos locales. • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35558 – SSRF in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35558
16 Feb 2021 — An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials. Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual hasta la versión 2.11.2. Hay un SSRF en la en la comprobación de acceso a MySQL, lo que permite a un atacante escanear los... • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-918: Server-Side Request Forgery (SSRF) •