Most recent entries from csaf_helmholzgmbhcokg

VDE-2021-057 — Helmholz: Privilege Escalation in shDialup (Update A)

Sun, 28 Mar 2021 13:03:00 +0000

In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service. In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

VDE-2021-058 — Helmholz: Remote user enumeration in myREX24/myREX24-virtual

Wed, 08 Dec 2021 13:04:00 +0000

An unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

VDE-2022-039 — Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual

Wed, 07 Sep 2022 10:56:00 +0000

Multiple vulnerabilities have been found in myREX24 and myREX24.virtual.

VDE-2022-017 — Helmholz: Unauthenticated user enumeration in myREX24 and myREX24.virtual

Wed, 07 Sep 2022 12:54:00 +0000

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

VDE-2023-008 — Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual

Mon, 15 May 2023 12:06:00 +0000

Two vulnerabilites have been discovered in myREX24 and myREX24.virtual in all versions through 2.13.3.

VDE-2023-029 — Helmholz: Cross-site Scripting vulnerability in REX 200/REX 250

Thu, 17 Aug 2023 12:00:00 +0000

A stored XXS vulnerability has been found in REX 200 and REX 250 in all versions before 7.3.2.

VDE-2023-043 — Helmholz: Vulnerability allows access to non-critical information in myREX24 and myREX24.virtual

Mon, 16 Oct 2023 08:38:00 +0000

A vulnerability in the affected products allows an authenticated, low-privileged attacker to gain unauthorized read access to limited, non-critical device information. The issue arises from improper access validation.

VDE-2024-032 — Helmholz: REX 100 vulnerable to OS command injection

Wed, 03 Jul 2024 09:00:00 +0000

There exists a vulnerability in all REX 100 devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests.

Update: 03.07.2024 3:30pm In section Reported by Sebastian Dietz (CyberDanube) was added.

VDE-2024-044 — Helmholz: Multiple products are vulnerable to regreSSHion

Wed, 31 Jul 2024 08:00:00 +0000

Several Helmholz products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

VDE-2024-066 — Helmholz: Multiple Vulnerabilities in Helmholz REX100 Product

Tue, 15 Oct 2024 08:00:00 +0000

Multiple vulnerabilities have been discovered in REX100 allowing for RCE or unauthorized file access.