Summary
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
Details
Impact
Some limited sensitive data can be accessed and a DoS can be performed targeting a specific user/device.
Remediation
Update to latest version: 2.18.0
Vulnerabilities 1
-
High 8.2
MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24
An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
Revision history
-
#1
Initial revision.
References
-
Helmholz GmbH & Co. KG Advisories
https://www.helmholz.de
-
CERT@VDE Security Advisories for Helmholz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/helmholz
-
VDE-2025-037: Vulnerabilities in myREX24/myREX24.virtual - HTML
https://certvde.com/en/advisories/VDE-2025-037