myREX24.virtual vulnerabilities
5 known vulnerabilities in myREX24.virtual from Helmholz. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
mbCONNECT24: Authorization Bypass Through User-Controlled Key
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
- 8.2 High severity
mbCONNECT24: Missing Authentication for Critical Functionality
An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
- 7.8 High severity
mbNET.mini: Inadequate Encryption Strength
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
- 7.5 High severity
mbCONNECT24: Use of Weak Credentials
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
- 8.8 High severity
mbCONNECT24: Authorization Bypass Through User-Controlled Key
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account