VDE-2024-030 — MB connect line: mbNET.mini vulnerable to OS command injection

Summary

There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests.
Update: 03.07.2024 3:30 pm
In section Reported by Sebastian Dietz (CyberDanube) was added.

Details

Impact
See CVE description.

Mitigation
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Remediation
Update to latest version: 2.2.13

Vulnerabilities 1

High 7.2

CVE-2024-5672

Red Lion Europe: mbNET.mini vulnerable to OS command injection

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command.

Helmholz Red Lion Europe REX 100 mbNET.mini

Jul 3, 2024

Revision history

2024-07-03 #1
Initial revision.

References

CERT@VDE Security Advisories for MB connect line GmbH
https://certvde.com/en/advisories/vendor/mbconnectline/
VDE-2024-030: MB connect line: mbNET.mini vulnerable to OS command injection - HTML
https://certvde.com/en/advisories/VDE-2024-030/