Medium VDE-2023-012 1 CVE

MB connect line: Cross-site Scripting vulnerability in mbNET/mbNET.rokey

Published Aug 17, 2023 · Updated Aug 17, 2023

Vendor: MB connect line Vendor: Red Lion Europe Product: mbNET Product: mbNET Product: mbNET.rokey Product: mbNET.rokey

Summary

A stored XXS vulnerability has been found in mbNET and mbNET/.rokey in all versions before 7.3.2.

Details

Impact
A remote, authenticated attacker can fully compromise the browser session of all users accessing the devices web interface.

Remediation
Update to 7.3.2

Vulnerabilities 1

Medium 4.8

CVE-2023-34412

Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).

Helmholz Red Lion Europe mbNET REX 200

Aug 17, 2023

Revision history

2023-08-17 #1
Initial revision.

References

CERT@VDE Security Advisories for MB connect line GmbH
https://certvde.com/en/advisories/vendor/mbconnectline/
VDE-2023-012: MB connect line: Cross-site Scripting vulnerability in mbNET/mbNET.rokey - HTML
https://certvde.com/en/advisories/VDE-2023-012/