Description
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corresponding permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | mymbCONNECT24 | 2.6.2 – ≤ 2.11.2 | — |
| MB connect line | mbCONNECT24 | 2.6.2 – ≤ 2.11.2 | — |
| Helmholz | myREX24 | 2 – ≤ 2.11.2 | — |
| Helmholz | myREX24.virtual | 2.11.2 | — |
Advisories 3
- VDE-2022-039 Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual CERT@VDE · Sep 7, 2022
- VDE-2021-003 MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A) CERT@VDE · Sep 7, 2022
- ICSA-21-061-03 MB connect line mbCONNECT24, mymbCONNECT24 CISA ICS & IT advisories · Mar 2, 2021