Description
In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | mymbCONNECT24 | 2 – ≤ 2.11.2 | — |
| MB connect line | mbCONNECT24 | 2 – ≤ 2.11.2 | — |
| Helmholz | myREX24 | 2 – ≤ 2.11.2 | — |
| Helmholz | myREX24.virtual | 2 – ≤ 2.11.2 | — |
Advisories 2
- VDE-2021-030 MB connect line: two vulnerabilities in mymbCONNECT24, mbCONNECT24 (Update A) CERT@VDE · Jun 6, 2025
- VDE-2022-039 Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual CERT@VDE · Sep 7, 2022