MB connect line: Multiple Vulnerabilities in MB connect line Products
Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNECT24, mbNET HW1, and mbSPIDER products. CVE-2024-45275 affects only the mbNET HW1 product.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45275US | critical9.8OT erhöht | — | ||
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices. | ||||
| CVE-2024-45273US | high7.8 | — | ||
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | ||||
| CVE-2024-45272US | — | — | ||
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Security Incident Management SIM#2024-04 - PDFself
- VDE-2024-068: MB connect line: Multiple Vulnerabilities in MB connect line Products - HTMLself
- CERT@VDE Security Advisories for MB connect lineexternal
- Product security incident reportsexternal
- VDE-2024-068: MB connect line: Multiple Vulnerabilities in MB connect line Products - CSAFself
Behebungen (3)
- Behoben
**Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.
- Behoben
Update mbCONNECT24, mymbCONNECT24 to the version 2.16.3
- Behoben
Update mbNET/mbNET.rokey to the version 8.2.1\ Update mbCONNECT24, mymbCONNECT24 to the version 2.16.3\ **Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan