Summary
An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.
Details
Impact
This vulnerability allows an authenticated remote attacker to fully compromise the system by executing arbitrary OS commands.
Remediation
Update mbNET/mbNET.rokey to at least version 7.3.0\
**Note**: mbNET HW1 is EOL and will not receive any further updates.
Vulnerabilities 1
-
High 7.2
High Privilege RCE via LUA Sandbox Escape
A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.
Revision history
-
#1
Initial revision.
References
-
Product security incident reports
https://mbconnectline.com/security-advice
-
CERT@VDE Security Advisories for MB connect line
https://certvde.com/en/advisories/vendor/mbconnectline
-
VDE-2025-065: MB connect line: Sandbox escape in mbNET's LUA interpreter - HTML
https://certvde.com/en/advisories/VDE-2025-065