CVE-2024-23943criticalCWE-306

CVE-2024-23943: falha crítica em mbCONNECT24

MB connect line: Cloud API access due to a lack of authentication for a critical function

Publicada em

Seguir esta CVE+ Monitorar mbCONNECT24+ Monitorar mymbCONNECT24

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.6%
An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
MB connect line · mbCONNECT24MB connect line · mbNETMB connect line · mbNET.rokeyMB connect line · mymbCONNECT24
CVEs relacionadas — mbCONNECT24

No mesmo produto, das mais perigosas para as menos.

CVE-2021-34580HIGHRemote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0EPSS 1.0%CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 1.0%CVE-2021-34575HIGHInformation Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0EPSS 1.0%CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2020-12528MEDIUMCVE-2020-12528EPSS 0.9%