High VDE-2021-037 1 CVE

MB connect line: Remote user enumeration in mbCONNECT24/mymbCONNECT24

Published Oct 27, 2021 · Updated May 14, 2025 · Revision 2

Vendor: MB connect line Product: mbCONNECT24 Product: mymbCONNECT24

Summary

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.

Details

Impact
Please consult the CVE Entry above.

Remediation
Update mbCONNECT24/mymbCONNECT24 to 2.10.1

Vulnerabilities 1

High 7.5

CVE-2021-34580

Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0

In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

MB connect line mymbCONNECT24 mbCONNECT24

Oct 27, 2021

Revision history

2025-05-14 #2
Fix: firmware category
2021-10-27 #1
Initial revision.

References

MB connect line advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/mbconnectline/
VDE-2021-037: MB connect line: Remote user enumeration in mbCONNECT24/mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2021-037