VDE-2023-043 — Helmholz: Vulnerability allows access to non-critical information in myREX24 and myREX24.virtual

Summary

A vulnerability in the affected products allows an authenticated, low-privileged attacker to gain unauthorized read access to limited, non-critical device information. The issue arises from improper access validation.

Details

Remediation
Update to latest Version 2.14.3

Impact
An authenticated, low privileged attacker can gain read access to limited, non-critical device information in his account he should not have access to.

Vulnerabilities 1

Medium 4.3

CVE-2023-4834

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an…

Helmholz Red Lion Europe myREX24.virtual myREX24

Oct 16, 2023

Revision history

2023-10-16 #1.0.0
Initial revision.

References

VDE-2023-043: Helmholz: Vulnerability allows access to non-critical information in myREX24 and myREX24.virtual - HTML
https://certvde.com/en/advisories/VDE-2023-043/
Vendor PSIRT
https://www.helmholz.de
CERT@VDE Security Advisories for Helmholz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/helmholz/