Helmholz: Multiple Vulnerabilities in Helmholz products
Multiple vulnerabilities have been discovered in Helmholz products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the myREX24V2 and myREX24V2.virtual products. CVE-2024-45273 affects the REX 200/REX 250, myREX24V2, myREX24V2.virtual products. CVE-2024-45275 affects only the REX 200 / REX 250 products.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45275US | critical9.8OT erhöht | — | ||
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices. | ||||
| CVE-2024-45273US | high7.8 | — | ||
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | ||||
| CVE-2024-45272US | — | — | ||
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- Behoben
**Note**: REX 300 is EOL and will not receive any further updates.
- Behoben
Update REX 200 / REX 250 to the version 8.2.1\ Update myREX24V2, myREX24V2.virtual to the version 2.16.3\ **Note**: REX 300 is EOL and will not receive any further updates.
- Behoben
Update myREX24V2, myREX24V2.virtual to the version 2.16.3
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan