Summary
Two vulnerabilities in myREX24/myREX24.virtual can lead to user enumeration an password bypass.
Details
Impact
CVE-2025-3091: An attacker in possession of the second factor for an user can login as that user without knowledge of the password (first factor)
CVE-2025-3092: An unprotected endpoint can by used to enumerate valid user names.
Remediation
CVE-2025-3091: Update to latest version: 2.16.5
CVE-2025-3092: Update to latest version: 2.18.0
Vulnerabilities 2
-
High 7.5
MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
-
High 7.5
MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24
An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
Revision history
-
#1
Initial revision.
References
-
Helmholz GmbH & Co. KG Advisories
https://www.helmholz.de
-
CERT@VDE Security Advisories for Helmholz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/helmholz
-
VDE-2025-038: Vulnerabilities in myREX24/myREX24.virtual - HTML
https://certvde.com/en/advisories/VDE-2025-038