Helmholz: Multiple vulnerabilities in REX 100
Multiple vulnerabilities in all REX 100 devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41681US | — | — | ||
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. | ||||
| CVE-2025-41679US | high7.5 | — | ||
An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Confto… | ||||
| CVE-2025-41678US | high7.2 | — | ||
A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement. | ||||
| CVE-2025-41677US | — | — | ||
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession. | ||||
| CVE-2025-41676US | — | — | ||
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. | ||||
| CVE-2025-41675US | — | — | ||
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements… | ||||
| CVE-2025-41674US | — | — | ||
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS… | ||||
| CVE-2025-41673US | — | — | ||
A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS co… | ||||
references
External citations — patches, advisories, analysis.
remediations (16)
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
- MitigationFirmware <2.3.3 installed on REX 100
Enable "Lock network configuration (Conftool)" in device configuration (enabled by default after device comes online for the first time).
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
- FixedFirmware <2.3.3 installed on REX 100
Update to latest version: 2.3.3
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan