Description
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | mbCONNECT24 | < 2.16.5 | 2.16.5 |
| MB connect line | mymbCONNECT24 | < 2.18.0, < 2.16.5 | 2.18.0 |
| Helmholz | myREX24 | < 2.18.0, < 2.16.5 | 2.18.0 |
| Helmholz | myREX24.virtual | < 2.18.0, < 2.16.5 | 2.18.0 |
Advisories 2
- VDE-2025-038 Vulnerabilities in myREX24/myREX24.virtual CERT@VDE · Jun 24, 2025
- VDE-2025-035 Vulnerabilities in mbCONNECT24/mymbCONNECT24 CERT@VDE · Jun 24, 2025