CVE-2023-4834

Summary: CVE-2023-4834 affects Red Lion Europe mbCONNECT24, mymbCONNECT24, and Helmholz myREX24 / myREX24.virtual up to version 2.14.2. The root cause is an improperly implemented access validation, enabling an authenticated, low-privileged attacker to read limited, non-critical device informatio...

CVE-2022-22520

CVE-2022-22520 describes a remote, unauthenticated user enumeration vulnerability in MB connect line products: mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual up to v2.11.2. The underlying issue is that the webservice allows attackers to enumerate valid users by sending specific...

CVE-2020-35566

The CVE-2020-35566 issue affects MB connect line products: mymbCONNECT24 (up to v2.11.2), mbCONNECT24, and Helmholz myREX24 / myREX24.virtual (up to v2.11.2). The vulnerability is a Local File Inclusion that enables an attacker to read arbitrary JSON files. Connected sources consistently describe...

CVE-2020-35558

CVE-2020-35558 affects MB connect line products MB CONNECT LINE mymbCONNECT24, mbCONNECT24 and Helmholz myREX24/myREX24.virtual up to version 2.11.2. The issue is a server-side request forgery (SSRF) in the MySQL access check that allows an attacker to scan for open ports and obtain information a...

CVE-2020-12527

CVE-2020-12527 affects MB connect line products: mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual (versions up to v2.11.2). The root cause is improper access validation that lets a logged-in user perform privileged actions (shutdown/reboot) on devices in their account without the...

CVE-2020-35557

CVE-2020-35557 corresponds to a privilege validation flaw in MB connect line products: mymbCONNECT24, mbCONNECT24, Helmholz myREX24 and myREX24.virtual up to version 2.11.2. The issue allows a logged-in user to access devices in an account to which they should not have access due to improper acce...

CVE-2020-35561

Summary of CVE-2020-35561 : In MB connect line products (mymbCONNECT24 and mbCONNECT24) and related Helmholz components, there is a Server-Side Request Forgery (SSRF) vulnerability in the HA module across all versions up to v2.11.2. This allows an unauthenticated attacker to scan for open ports o...

CVE-2020-35570

MB connect line products mymbCONNECT24, mbCONNECT24, Helmholz myREX24 and myREX24.virtual (through 2.11.2) are affected by a forceful-browsing vulnerability that allows an unauthenticated attacker to access restricted files. The issue is described under CVE-2020-35570 as an access to restricted f...

CVE-2020-35568

MB Connect Line products mbCONNECT24, mymbCONNECT24, and Helmholz MyREX24/MyREX24.virtual (versions through 2.11.2) are affected by CVE-2020-35568 due to an incomplete filter on a database response that allows an authenticated attacker to gain non-public information about other users and devices ...

CVE-2021-34574

CVE-2021-34574 affects MB connect line products: mymbCONNECT24, mbCONNECT24, Helmholz myREX24 and myREX24.virtual up to version 2.11.2. An authenticated attacker can change their account password by intercepting and modifying the password-change request sent to the server, bypassing the password ...