Summary
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
Details
Impact
Some limited sensitive data can be accessed and a DoS can be performed targeting a specific user/device.
Remediation
Update to latest version: 2.18.0
Vulnerabilities 1
-
High 8.2
MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24
An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
Revision history
-
#1
Initial revision.
References
-
MB connect line GmbH Advisories
https://mbconnectline.com/security-advice
-
CERT@VDE Security Advisories for MB connect line GmbH
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2025-034: Vulnerabilities in mbCONNECT24/mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2025-034