CVE-2024-45273

MB connect line/Helmholz: Weak encryption of configuration file

Severity Score

8.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.

Un atacante local no autenticado puede descifrar el archivo de configuración del dispositivo y, por lo tanto, comprometer el dispositivo debido a una implementación débil del cifrado utilizado.

*Credits: Moritz Abrell, SySS GmbH

CVSS Scores

CERT VDEv3.1 8.4

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-08-26 CVE Reserved
2024-10-15 CVE Published
2024-10-16 CVE Updated
2024-10-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-261: Weak Encoding for Password

CAPEC

References (4)

URL	Tag	Source
https://cert.vde.com/en/advisories/VDE-2024-056
https://cert.vde.com/en/advisories/VDE-2024-066
https://cert.vde.com/en/advisories/VDE-2024-068
https://cert.vde.com/en/advisories/VDE-2024-069

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
MB Connect Line Search vendor "MB Connect Line"		MbNET.mini Search vendor "MB Connect Line" for product "MbNET.mini"				>= 0.0.0 <= 2.2.13 Search vendor "MB Connect Line" for product "MbNET.mini" and version " >= 0.0.0 <= 2.2.13"		en		Affected
MB Connect Line Search vendor "MB Connect Line"		MbNET/mbNET.rokey Search vendor "MB Connect Line" for product "MbNET/mbNET.rokey"				>= 0.0.0 <= 8.2.0 Search vendor "MB Connect Line" for product "MbNET/mbNET.rokey" and version " >= 0.0.0 <= 8.2.0"		en		Affected
MB Connect Line Search vendor "MB Connect Line"		MbNET HW1 Search vendor "MB Connect Line" for product "MbNET HW1"				>= 0.0.0 <= 5.1.11 Search vendor "MB Connect Line" for product "MbNET HW1" and version " >= 0.0.0 <= 5.1.11"		en		Affected
MB Connect Line Search vendor "MB Connect Line"		MbSPIDER Search vendor "MB Connect Line" for product "MbSPIDER"				>= 0.0.0 <= 2.6.5 Search vendor "MB Connect Line" for product "MbSPIDER" and version " >= 0.0.0 <= 2.6.5"		en		Affected
MB Connect Line Search vendor "MB Connect Line"		MbCONNECT24 Search vendor "MB Connect Line" for product "MbCONNECT24"				>= 0.0.0 <= 2.16.2 Search vendor "MB Connect Line" for product "MbCONNECT24" and version " >= 0.0.0 <= 2.16.2"		en		Affected
MB Connect Line Search vendor "MB Connect Line"		MymbCONNECT24 Search vendor "MB Connect Line" for product "MymbCONNECT24"				>= 0.0.0 <= 2.16.2 Search vendor "MB Connect Line" for product "MymbCONNECT24" and version " >= 0.0.0 <= 2.16.2"		en		Affected
Helmholz Search vendor "Helmholz"		REX100 Search vendor "Helmholz" for product "REX100"				>= 0.0.0 <= 2.2.13 Search vendor "Helmholz" for product "REX100" and version " >= 0.0.0 <= 2.2.13"		en		Affected
Helmholz Search vendor "Helmholz"		REX200/250 Search vendor "Helmholz" for product "REX200/250"				>= 0.0.0 <= 8.2.0 Search vendor "Helmholz" for product "REX200/250" and version " >= 0.0.0 <= 8.2.0"		en		Affected
Helmholz Search vendor "Helmholz"		MyREX24 V2 Search vendor "Helmholz" for product "MyREX24 V2"				>= 0.0.0 <= 2.16.2 Search vendor "Helmholz" for product "MyREX24 V2" and version " >= 0.0.0 <= 2.16.2"		en		Affected
Helmholz Search vendor "Helmholz"		MyREX24.virtual Search vendor "Helmholz" for product "MyREX24.virtual"				>= 0.0.0 <= 2.16.2 Search vendor "Helmholz" for product "MyREX24.virtual" and version " >= 0.0.0 <= 2.16.2"		en		Affected
Helmholz Search vendor "Helmholz"		REX300 Search vendor "Helmholz" for product "REX300"				>= 0.0.0 <= 5.1.11 Search vendor "Helmholz" for product "REX300" and version " >= 0.0.0 <= 5.1.11"		en		Affected