CVE-2024-45272

Published: Oct 15, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: info@cert.vde.com (Secondary)

Description

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.

Affected (13)

Products: Helmholz: Myrex24 V2 Virtual Server, Rex 300 Firmware, Rex 200 Firmware, Rex 250 Firmware · Mbconnectline: Mbconnect24, Mymbconnect24, Mbspider Mdh 905 Firmware, Mbspider Mdh 915 Firmware, Mbspider Mdh 906 Firmware, Mbspider Mdh 916 Firmware, Mbnet Hw1 Firmware, Mbnet Firmware, Mbnet.rokey Firmware

Helmholz

4 products

Myrex24 V2 Virtual Server

9 products

Mbspider Mdh 905 Firmware

Mbspider Mdh 915 Firmware

Mbspider Mdh 906 Firmware

Mbspider Mdh 916 Firmware

Mbnet Hw1 Firmware

Mbnet Firmware

Mbnet.rokey Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Helmholz Myrex24 V2 Virtual Server	Before 2.16.3

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Helmholz Rex 300 Firmware	Up to 5.1.11

Running on/with	Platform Versions
Helmholz Rex 300	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Helmholz Rex 200 Firmware	Before 8.2.1

Running on/with	Platform Versions
Helmholz Rex 200	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Helmholz Rex 250 Firmware	Before 8.2.1

Running on/with	Platform Versions
Helmholz Rex 250	All versions

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Mbconnectline Mbconnect24	Before 2.16.3
Mbconnectline Mymbconnect24	Before 2.16.3

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbspider Mdh 905 Firmware	Up to 2.6.5

Running on/with	Platform Versions
Mbconnectline Mbspider Mdh 905	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbspider Mdh 915 Firmware	Up to 2.6.5

Running on/with	Platform Versions
Mbconnectline Mbspider Mdh 915	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbspider Mdh 906 Firmware	Up to 2.6.5

Running on/with	Platform Versions
Mbconnectline Mbspider Mdh 906	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbspider Mdh 916 Firmware	Up to 2.6.5

Running on/with	Platform Versions
Mbconnectline Mbspider Mdh 916	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbnet Hw1 Firmware	Up to 5.1.11

Running on/with	Platform Versions
Mbconnectline Mbnet Hw1	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbnet Firmware	Before 8.2.1

Running on/with	Platform Versions
Mbconnectline Mbnet	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mbconnectline Mbnet.rokey Firmware	Before 8.2.1

Running on/with	Platform Versions
Mbconnectline Mbnet.rokey	All versions

Related CWEs

CWE-1391

Use of Weak Credentials

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

References (3)

https://cert.vde.com/en/advisories/VDE-2024-068

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2024-069

Source: info@cert.vde.com

Third Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-061.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.