Helmholz: Multiple Vulnerabilities in Helmholz products
Multiple vulnerabilities have been discovered in Helmholz products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the myREX24V2 and myREX24V2.virtual products. CVE-2024-45273 affects the REX 200/REX 250, myREX24V2, myREX24V2.virtual products. CVE-2024-45275 affects only the REX 200 / REX 250 products.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45275US | critical9.8OT elevated | — | ||
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices. | ||||
| CVE-2024-45273US | high7.8 | — | ||
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | ||||
| CVE-2024-45272US | — | — | ||
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | ||||
references
External citations — patches, advisories, analysis.
remediations (3)
- Fixed
**Note**: REX 300 is EOL and will not receive any further updates.
- Fixed
Update REX 200 / REX 250 to the version 8.2.1\ Update myREX24V2, myREX24V2.virtual to the version 2.16.3\ **Note**: REX 300 is EOL and will not receive any further updates.
- Fixed
Update myREX24V2, myREX24V2.virtual to the version 2.16.3
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan