In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service. In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

An unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

Multiple vulnerabilities have been found in myREX24 and myREX24.virtual.

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

Two vulnerabilites have been discovered in myREX24 and myREX24.virtual in all versions through 2.13.3.

A stored XXS vulnerability has been found in REX 200 and REX 250 in all versions before 7.3.2.

A vulnerability in the affected products allows an authenticated, low-privileged attacker to gain unauthorized read access to limited, non-critical device information. The issue arises from improper access validation.

There exists a vulnerability in all REX 100 devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests.

Update: 03.07.2024 3:30pm  In section Reported by Sebastian Dietz (CyberDanube) was added.

Several Helmholz products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

Multiple vulnerabilities have been discovered in REX100 allowing for RCE or unauthorized file access.