High VDE-2021-058 1 CVE

Helmholz: Remote user enumeration in myREX24/myREX24-virtual

Published Dec 8, 2021 · Updated May 14, 2025 · Revision 2

Vendor: Helmholz Product: myREX24 Product: myREX24.virtual

Summary

An issue was discovered in the myREX24 and myREX24-virtual software in all versions through V2.9.0.

Details

Update myREX24/myREX24-virtual to 2.10.1

Vulnerabilities 1

High 7.5

CVE-2021-34580

Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0

In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

MB connect line mymbCONNECT24 mbCONNECT24

Oct 27, 2021

Revision history

2025-05-14 #2
Fix: added distribution
2021-12-08 #1
initial revision

References

VDE-2021-058: Helmholz: Remote user enumeration in myREX24/myREX24-virtual - HTML
https://certvde.com/de/advisories/VDE-2021-058/
CERT@VDE Security Advisories for Helmholz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/helmholz/