Vulnerabilities in mbCONNECT24/mymbCONNECT24
The data24 service that is bundled with every installation of mbCONNECT24/mymbCONNECT24 has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23943US | —OT elevated | — | ||
An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected. | ||||
| CVE-2024-23942US | —OT elevated | — | ||
A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from a… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
CVE-2024-23942: If the device's serial number is known to mbCONNECT24/mymbCONNECT24 before the downloadable configuration is created, that configuration will be encrypted allowing only the correct device to decrypt it.
- Fixed
Update to latest version: 2.16.2 CVE-2024-23943: This fix does not apply to mbNET/mbNET.rokey devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan