Most recent entries from csaf_mbconnectlinegmbh

VDE-2021-003 — MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A)

Wed, 07 Sep 2022 10:46:00 +0000

Multiple vulnerabilities have been found in mymbCONNECT24 and mbCONNECT24. Update A, 2022-09-07:

Affected Products: updated affected versions due to incomplete fixes of some CVEs. See Solution for details. Solution: updated version information. Solution: Added Fix for CVE-2020-35561. Solution: Added MFA remark for CVE-2020-35565.

VDE-2022-011 — MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24

Wed, 07 Sep 2022 12:50:00 +0000

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

VDE-2023-012 — MB connect line: Cross-site Scripting vulnerability in mbNET/mbNET.rokey

Thu, 17 Aug 2023 12:00:00 +0000

A stored XXS vulnerability has been found in mbNET and mbNET/.rokey in all versions before 7.3.2.

VDE-2024-042 — MB connect line: Multiple products are vulnerable to regreSSHion

Thu, 17 Aug 2023 12:00:00 +0000

Several Red Lion Europe products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

VDE-2023-041 — MB connect line: Vulnerability allows access to non-critical information in mbCONNECT24 and mymbCONNECT24

Mon, 16 Oct 2023 08:38:00 +0000

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.

VDE-2024-030 — MB connect line: mbNET.mini vulnerable to OS command injection

Wed, 03 Jul 2024 09:00:00 +0000

There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30 pm In section Reported by Sebastian Dietz (CyberDanube) was added.

VDE-2020-035 — MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1

Fri, 18 Sep 2020 12:30:00 +0000

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

VDE-2021-012 — MB connect line: multiple products partially affected by DNSpooq

Mon, 26 Apr 2021 08:04:00 +0000

Multiple issues have been identified in dnsmasq < 2.83

VDE-2021-017 — MB connect line: Privilege escalation in mbDIALUP

Thu, 22 Jul 2021 11:35:00 +0000

Multiple Vulnerabilities in mbConnect24serv (a software service of mbDIALUP) can lead to arbitrary code execution due to improper privilege management.

Update A, 2021-11-24

corrected fixed version in solution from 3.9R0.4 to 3.9R0.5

Update B, 2022-03-28

Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

VDE-2021-031 — MB connect line: Apache Guacamole related vulnerabilities in mbCONNECT24

Thu, 22 Jul 2021 11:33:00 +0000

Two vulnerabilities in mbCONNECT24 and mymbCONNECT24 can lead to information disclosure and arbitrary code execution.

Please consult the CVE entries for details.