Medium VDE-2022-017 1 CVE

Helmholz: Unauthenticated user enumeration in myREX24 and myREX24.virtual

Published Sep 7, 2022 · Updated May 14, 2025 · Revision 2

Vendor: Helmholz Product: myREX24 Product: myREX24.virtual

Summary

An issue was discovered in myREX24 and myREX24.virtual in all versions through 2.11.2.

Details

Impact
A remote, unauthenticated attacker can enumerate valid users with a timing attack against the webserver.

Remediation
Update to Version 2.12.1

Vulnerabilities 1

Medium 5.3

CVE-2022-22520

User enumeration vulnerability in MB connect line and Helmholz products

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

MB connect line Helmholz mymbCONNECT24 mbCONNECT24

Sep 14, 2022

Revision history

2025-05-14 #2
Fix: added distribution
2022-09-07 #1
initial revision

References

VDE-2022-017: Helmholz: Unauthenticated user enumeration in myREX24 and myREX24.virtual - HTML
https://certvde.com/de/advisories/VDE-2022-017/
CERT@VDE Security Advisories for Helmholz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/helmholz/