Description
A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MB connect line | mbNET.mini | 0.0.0 – < 2.3.3 | 2.3.3 |
| Helmholz | REX 100 | 0.0.0 – < 2.3.3 | 2.3.3 |
Advisories 2
- VDE-2025-059 Helmholz: Multiple vulnerabilities in REX 100 CERT@VDE · Jul 21, 2025
- VDE-2025-058 MB connect line: Multiple vulnerabilities in mbNET.mini CERT@VDE · Jul 21, 2025