Description
A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | mymbCONNECT24 | 2 – ≤ 2.11.2 | — |
| MB connect line | mbCONNECT24 | 2 – ≤ 2.11.2 | — |
| Helmholz | myREX24 | 2 – ≤ 2.11.2 | — |
| Helmholz | myREX24.virtual | 2 – ≤ 2.11.2 | — |
Advisories 2
- VDE-2022-017 Helmholz: Unauthenticated user enumeration in myREX24 and myREX24.virtual CERT@VDE · May 14, 2025
- VDE-2022-011 MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24 CERT@VDE · Sep 7, 2022