MB connect line: Multiple Vulnerabilities in MB connect line Products
Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNECT24, mbNET HW1, and mbSPIDER products. CVE-2024-45275 affects only the mbNET HW1 product.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45275US | critical9.8OT elevated | — | ||
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices. | ||||
| CVE-2024-45273US | high7.8 | — | ||
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | ||||
| CVE-2024-45272US | — | — | ||
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | ||||
references
External citations — patches, advisories, analysis.
- Security Incident Management SIM#2024-04 - PDFself
- VDE-2024-068: MB connect line: Multiple Vulnerabilities in MB connect line Products - HTMLself
- CERT@VDE Security Advisories for MB connect lineexternal
- Product security incident reportsexternal
- VDE-2024-068: MB connect line: Multiple Vulnerabilities in MB connect line Products - CSAFself
remediations (3)
- Fixed
**Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.
- Fixed
Update mbCONNECT24, mymbCONNECT24 to the version 2.16.3
- Fixed
Update mbNET/mbNET.rokey to the version 8.2.1\ Update mbCONNECT24, mymbCONNECT24 to the version 2.16.3\ **Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan