Summary
Two vulnerabilities in mbCONNECT24/mymbCONNECT24 can lead to user enumeration an password bypass.
Details
Impact
CVE-2025-3091: An attacker in possession of the second factor for an user can login as that user without knowledge of the password (first factor)
CVE-2025-3092: An unprotected endpoint can by used to enumerate valid user names.
Remediation
CVE-2025-3091: Update to latest version: 2.16.5
CVE-2025-3092: Update to latest version: 2.18.0
Vulnerabilities 2
-
High 7.5
MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
-
High 7.5
MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24
An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
Revision history
-
#1
Initial revision.
References
-
MB connect line GmbH Advisories
https://mbconnectline.com/security-advice
-
CERT@VDE Security Advisories for MB connect line GmbH
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2025-035: Vulnerabilities in mbCONNECT24/mymbCONNECT24 - HTML
https://certvde.com/en/advisories/VDE-2025-035