Most recent entries from csaf_mbconnectlinegmbh

VDE-2021-003 — MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A)

2022-09-07T10:46:00+00:00

Multiple vulnerabilities have been found in mymbCONNECT24 and mbCONNECT24. Update A, 2022-09-07:

Affected Products: updated affected versions due to incomplete fixes of some CVEs. See Solution for details. Solution: updated version information. Solution: Added Fix for CVE-2020-35561. Solution: Added MFA remark for CVE-2020-35565.

VDE-2022-011 — MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24

2022-09-07T12:50:00+00:00

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

VDE-2023-012 — MB connect line: Cross-site Scripting vulnerability in mbNET/mbNET.rokey

2023-08-17T12:00:00+00:00

A stored XXS vulnerability has been found in mbNET and mbNET/.rokey in all versions before 7.3.2.

VDE-2024-042 — MB connect line: Multiple products are vulnerable to regreSSHion

2023-08-17T12:00:00+00:00

Several Red Lion Europe products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

VDE-2023-041 — MB connect line: Vulnerability allows access to non-critical information in mbCONNECT24 and mymbCONNECT24

2023-10-16T08:38:00+00:00

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.

VDE-2024-030 — MB connect line: mbNET.mini vulnerable to OS command injection

2024-07-03T09:00:00+00:00

There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30 pm In section Reported by Sebastian Dietz (CyberDanube) was added.

VDE-2020-035 — MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1

2025-05-14T12:28:19+00:00

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

VDE-2021-012 — MB connect line: multiple products partially affected by DNSpooq

2025-05-14T12:28:19+00:00

Multiple issues have been identified in dnsmasq < 2.83

VDE-2021-017 — MB connect line: Privilege escalation in mbDIALUP

2025-05-14T12:28:19+00:00

Multiple Vulnerabilities in mbConnect24serv (a software service of mbDIALUP) can lead to arbitrary code execution due to improper privilege management.

Update A, 2021-11-24

corrected fixed version in solution from 3.9R0.4 to 3.9R0.5

Update B, 2022-03-28

Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

VDE-2021-031 — MB connect line: Apache Guacamole related vulnerabilities in mbCONNECT24

2025-05-14T12:28:19+00:00

Two vulnerabilities in mbCONNECT24 and mymbCONNECT24 can lead to information disclosure and arbitrary code execution.

Please consult the CVE entries for details.