CVE-2024-45273

MB connect line/Helmholz: Weak encryption of configuration file

CVSS 8.4 HIGHEPSS 0.1%CWE-261

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Helmholz · myREX24 V2 Helmholz · myREX24.virtual Helmholz · REX100 Helmholz · REX200/250 Helmholz · REX300 MB connect line · mbCONNECT24 MB connect line · mbNET HW1 MB connect line · mbNET/mbNET.rokey MB connect line · mbNET.mini MB connect line · mbSPIDER MB connect line · mymbCONNECT24

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://cert.vde.com/en/advisories/VDE-2024-056 https://cert.vde.com/en/advisories/VDE-2024-066 https://cert.vde.com/en/advisories/VDE-2024-068 https://cert.vde.com/en/advisories/VDE-2024-069 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-062.txt