CVE-2023-0985highCWE-639

CVE-2023-0985: high-severity vulnerability in mbCONNECT24

Helmholz and MB Connect Line: Account takeover via password reset in multiple products

Published · Updated

Follow this CVE+ Monitor mbCONNECT24+ Monitor mymbCONNECT24

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.8%
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Helmholz · myREX24Helmholz · myREX24.virtualMB Connect Line · mbCONNECT24MB Connect Line · mymbCONNECT24
Related CVEs — mbCONNECT24

In the same product, most dangerous first.

CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 1.0%CVE-2021-34574MEDIUMPassword policy evasion in products of MB connect line and HelmholzEPSS 0.7%CVE-2024-45272HIGHMB connect line/Helmholz: Generation of weak passwords vulnerabilityEPSS 0.6%CVE-2023-1779MEDIUMHelmholz and MB Connect Line: Account takeover via password reset in multiple productsEPSS 0.5%CVE-2025-3092HIGHMB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24EPSS 0.5%