CVE-2024-45273
High
Description
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
SeverityHigh
CVSS8.4
Exploit probability—
ProductMbconnectline Mbnet.mini Firmware
PublishedOct 15, 2024
First seenOct 15, 2024
Weakness typeCWE-261CWE-261
How to fix
Update
- mbconnectline mbnet.mini_firmware2.3.1 or later
- helmholz myrex24_v2_virtual_server2.16.3 or later
- helmholz rex_200_firmware8.2.1 or later
- helmholz rex_250_firmware8.2.1 or later
- helmholz rex_100_firmware2.3.1 or later
- mbconnectline mbconnect242.16.3 or later
- mbconnectline mymbconnect242.16.3 or later
- mbconnectline mbnet_firmware8.2.1 or later
- mbconnectline mbnet.rokey_firmware8.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mbconnectline mbnet.mini_firmware | v < 2.3.1 | 2.3.1 |
| helmholz myrex24_v2_virtual_server | v < 2.16.3 | 2.16.3 |
| helmholz rex_300_firmware | v ≤ 5.1.11 | — |
| helmholz rex_200_firmware | v < 8.2.1 | 8.2.1 |
| helmholz rex_250_firmware | v < 8.2.1 | 8.2.1 |
| helmholz rex_100_firmware | v < 2.3.1 | 2.3.1 |
| mbconnectline mbconnect24 | v < 2.16.3 | 2.16.3 |
| mbconnectline mymbconnect24 | v < 2.16.3 | 2.16.3 |
| mbconnectline mbspider_mdh_905_firmware | v ≤ 2.6.5 | — |
| mbconnectline mbspider_mdh_915_firmware | v ≤ 2.6.5 | — |
| mbconnectline mbspider_mdh_906_firmware | v ≤ 2.6.5 | — |
| mbconnectline mbspider_mdh_916_firmware | v ≤ 2.6.5 | — |
| mbconnectline mbnet_hw1_firmware | v ≤ 5.1.11 | — |
| mbconnectline mbnet_firmware | v < 8.2.1 | 8.2.1 |
| mbconnectline mbnet.rokey_firmware | v < 8.2.1 | 8.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.