VDE-2024-056

MB connect line: Multiple Vulnerabilities in mbNET.mini Product

view advisory published 2024-10-15

Multiple vulnerabilities have been discovered in MB connect line mbNET.mini product allowing for RCE or unauthorized file access.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-45276US	—OT elevated	0.63% (49th)	—	2024-10-15
An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.
CVE-2024-45275US	critical9.8OT elevated	0.80% (56th)	—	2024-10-15
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
CVE-2024-45274US	—OT elevated	1.53% (75th)	—	2024-10-15
An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.
CVE-2024-45273US	high7.8	0.09% (1st)	—	2024-10-15
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
CVE-2024-45271US	high7.8	0.31% (23rd)	—	2024-10-15
An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.

External citations — patches, advisories, analysis.

FixedFirmware <=2.2.13 installed on MB connect line mbNET.mini
Update mbNET.mini to the version 2.3.1
FixedFirmware <=2.2.13 installed on MB connect line mbNET.mini
Update mbNET.mini to the version 2.3.1
FixedFirmware <=2.2.13 installed on MB connect line mbNET.mini
Update mbNET.mini to the version 2.3.1
FixedFirmware <=2.2.13 installed on MB connect line mbNET.mini
Update mbNET.mini to the version 2.3.1
FixedFirmware <=2.2.13 installed on MB connect line mbNET.mini
Update mbNET.mini to the version 2.3.1

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.