CVE-2022-22520

mediumpriority · track · 0EPSS 0.010 · 63 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.01% (63rd) EPSS

CVSS 5.3 · medium

Is it mine?

16 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · helmholz_psirt · mb_connect_line_psirt

EPSS · scored 2026-10-27

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedmb_connect_line_psirt
Update to Version 2.12.1
Fixedhelmholz_psirt
Update to Version 2.12.1

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · info@cert.vde.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · Helmholz PSIRT

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · MB connect line PSIRT

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-204USCWE-204USCWE-204US

affected products (16)

Products and version ranges known to be affected.

mbCONNECT24≤ 2 ≤2.11.2enisa_euvdEU
myREX24≤ 2 ≤2.11.2enisa_euvdEU
myREX24.virtual≤ 2 ≤2.11.2enisa_euvdEU
mymbCONNECT24≤ 2 ≤2.11.2enisa_euvdEU
Firmware 2.12.1 installed on myREX24all versionsfixedhelmholz_psirtDE
Firmware 2.12.1 installed on myREX24.virtualall versionsfixedhelmholz_psirtDE
Firmware <=2.11.2 installed on myREX24all versionshelmholz_psirtDE
Firmware <=2.11.2 installed on myREX24.virtualall versionshelmholz_psirtDE
Firmware 2.12.1 installed on mbCONNECT24all versionsfixedmb_connect_line_psirtDE
Firmware 2.12.1 installed on mymbCONNECT24all versionsfixedmb_connect_line_psirtDE
Firmware <=2.11.2 installed on mbCONNECT24all versionsmb_connect_line_psirtDE
Firmware <=2.11.2 installed on mymbCONNECT24all versionsmb_connect_line_psirtDE
helmholz myrex24≤ 2.11.2nvdUScpe:2.3:a:helmholz:myrex24:*:*:*:*:*:*:*:*
helmholz myrex24.virtual≤ 2.11.2nvdUScpe:2.3:a:helmholz:myrex24.virtual:*:*:*:*:*:*:*:*
mbconnectline mbconnect24≤ 2.11.2nvdUScpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*
mbconnectline mymbconnect24≤ 2.11.2nvdUScpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

VDE-2022-011MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT242022-09-07csaf · mb_connect_line_psirtDE
An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.11.2.
VDE-2022-017Helmholz: Unauthenticated user enumeration in myREX24 and myREX24.virtual2022-09-07csaf · helmholz_psirtDE
An issue was discovered in myREX24 and myREX24.virtual in all versions through 2.11.2.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd helmholz_psirt mb_connect_line_psirt nvd NVD CVE.org MITRE

published 2022-09-14modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan