Skip to content
OpenAdvisories
High · 8.4 CVE-2024-45273 EUVD-2024-41406GHSA-r597-7j2h-6248

MB connect line/Helmholz: Weak encryption of configuration file

Published Oct 15, 2024 · Updated Oct 16, 2024 · Assigned by CERTVDE

Vendor: Helmholz Vendor: MB connect line Product: mbCONNECT24 Product: mbNET HW1 Product: mbNET.mini Product: mbNET/mbNET.rokey Product: mbSPIDER Product: mymbCONNECT24 Product: myREX24 V2 Product: myREX24.virtual Product: REX100 Product: REX200/250 Product: REX300

Description

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.

Affected products

VendorProductAffectedFixed
MB connect line mbNET.mini 0.0.0 – ≤ 2.2.13 —
MB connect line mbNET/mbNET.rokey 0.0.0 – ≤ 8.2.0 —
MB connect line mbNET HW1 0.0.0 – ≤ 5.1.11 —
MB connect line mbSPIDER 0.0.0 – ≤ 2.6.5 —
MB connect line mbCONNECT24 0.0.0 – ≤ 2.16.2 —
MB connect line mymbCONNECT24 0.0.0 – ≤ 2.16.2 —
Helmholz REX100 0.0.0 – ≤ <= 2.2.13 —
Helmholz REX200/250 0.0.0 – ≤ <= 8.2.0 —
Helmholz myREX24 V2 0.0.0 – ≤ <= 2.16.2 —
Helmholz myREX24.virtual 0.0.0 – ≤ <= 2.16.2 —
Helmholz REX300 0.0.0 – ≤ <= 5.1.11 —

Advisories 4

References