Skip to content
OpenAdvisories
Critical VDE-2024-010 2 CVEs

Vulnerabilities in mbCONNECT24/mymbCONNECT24

Published Mar 18, 2025 · Updated Aug 27, 2025 · Revision 5

Vendor: MB connect line Product: mbCONNECT24 Product: mbNET Product: mbNET.rokey Product: mymbCONNECT24

Summary

The data24 service that is bundled with every installation of mbCONNECT24/mymbCONNECT24 has two
serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity
and availability.

Details

Impact
CVE-2024-23943: A total loss of confidentiality and integrity, for individual devices or the whole service, is
possible.

CVE-2024-23942: An attacker in possession of the device's configuration file can impersonate the real
device. This also allows to prevent the real device from connecting successful.

Mitigation
CVE-2024-23942: If the device's serial number is known to mbCONNECT24/mymbCONNECT24 before the
downloadable configuration is created, that configuration will be encrypted allowing only the correct device to
decrypt it.

Remediation
Update to latest version: 2.16.2

CVE-2024-23943: This fix does not apply to mbNET/mbNET.rokey devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-23943

    MB connect line: Cloud API access due to a lack of authentication for a critical function

    An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.

    MB connect line mymbCONNECT24 mbCONNECT24 mbNET.rokey
  • High 7.1
    CVE-2024-23942

    MB connect line: Configuration File on the client workstation is not encrypted

    A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.

    MB connect line mymbCONNECT24 mbCONNECT24 mbNET.rokey

Revision history

  1. #1.1.3

    Update: CWE form CVE-2024-23942, Revision History

  2. #1.0.3

    Fix: added distribution

  3. #1.0.2

    Update: Fixed document reference URL

  4. #1.0.1

    Update: Fixed Document reference CSAF

  5. #1.0.0

    Initial revision.

References