Skip to content
OpenAdvisories
High VDE-2024-032 1 CVE

Helmholz: REX 100 vulnerable to OS command injection

Published Jul 3, 2024 · Updated Jul 3, 2024 · Revision 2

Vendor: Helmholz Product: REX 100

Summary

There exists a vulnerability in all REX 100 devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests.

Update: 03.07.2024 3:30pm 
In section Reported by Sebastian Dietz (CyberDanube) was added.

Details

Impact
See CVE description.

Mitigation
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Remediation
Update to latest version: 2.2.13

Vulnerabilities 1

  • High 7.2
    CVE-2024-5672

    Red Lion Europe: mbNET.mini vulnerable to OS command injection

    A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command.

    Helmholz Red Lion Europe REX 100 mbNET.mini

Revision history

  1. #1.0.1

    In section Reported by Sebastian Dietz (CyberDanube) was added.

  2. #1.0.0

    Initial revision.

References