VDE-2023-041 — MB connect line: Vulnerability allows access to non-critical information in mbCONNECT24 and mymbCONNECT24

Summary

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.

Details

Impact
An authenticated, low privileged attacker can gain read access to limited, non-critical device information in his account he should not have access to.

Remediation
Update to latest Version 2.14.3

Vulnerabilities 1

Medium 4.3

CVE-2023-4834

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an…

Helmholz Red Lion Europe myREX24.virtual myREX24

Oct 16, 2023

Revision history

2023-10-16 #1.0.0
Initial revision.

References

CERT@VDE Security Advisories for MB connect line GmbH
https://certvde.com/en/advisories/vendor/mbconnectline
VDE-2023-041: MB connect line: Vulnerability allows access to non-critical information in mbCONNECT24 and mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2023-041/
MB connect line Security Advice
https://mbconnectline.com/security-advice/