← Back

CVE-2021-34574

nvd nist
Published: Aug 2, 2021Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD (Secondary)

Description

In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.

Affected (4)

Mbconnectline
2 products
Mbconnect24
Mymbconnect24
Helmholz
2 products
Myrex24
Myrex24.virtual
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Mbconnect24
Up to 2.11.2
Mymbconnect24
Up to 2.11.2
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Myrex24
Up to 2.11.2
Myrex24.virtual
Up to 2.11.2

Related CWEs

CWE-669
Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References (4)

Source: info@cert.vde.com
Third Party Advisory
Source: info@cert.vde.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.