Helmholz vulnerabilities
We track 40 vulnerabilities in Helmholz products across 16 products. 40 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Helmholz vulnerabilities
- 7.5 High severity
mbCONNECT24: Weak Password Recovery Mechanism for Forgotten Password
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
- 7.5 High severity
mbCONNECT24: Use of Default Password
The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality.
- 9.3 Critical severity
mbCONNECT24: Improper Neutralization of Input During Web Page Generation
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of
- 8.1 High severity
mbCONNECT24: Cross-Site Request Forgery
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availabi
- 7.2 High severity
mbNET/mbNET.rokey: Improper Neutralization of Special Elements used in an OS Command
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can resu
- 8.4 High severity
mbNET/mbNET.rokey: Improper Validation of Specified Type of Input
A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- 7.1 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non
- 7.1 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole dat
- 7.1 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database a
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss o
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confiden
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentia
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- 7.5 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- 7.5 High severity
MB connect line mbCONNECT24: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confiden
- 9.8 Critical severity
MB connect line mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-
- 7.5 High severity
mbNET.mini: Out-of-bounds Write
An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.
- 7.2 High severity
mbNET.mini: Improper Neutralization of Special Elements used in an SQL Command
A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.
- 7.2 High severity
mbNET.mini: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.
- 7.2 High severity
mbNET.mini: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.
- 7.2 High severity
mbNET.mini: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.
- 7.5 High severity
mbCONNECT24: Authorization Bypass Through User-Controlled Key
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
- 8.2 High severity
mbCONNECT24: Missing Authentication for Critical Functionality
An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
- 9.8 Critical severity
mbNET.mini: Use of Hard-coded Credentials
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
- 7.8 High severity
mbNET.mini: Inadequate Encryption Strength
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
- 7.5 High severity
mbCONNECT24: Use of Weak Credentials
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
- 7.2 High severity
mbNET.mini: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
mbCONNECT24: Authorization Bypass Through User-Controlled Key
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account