REX100 vulnerabilities
4 known vulnerabilities in REX100 from Helmholz. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
mbNET/mbNET.rokey: Improper Neutralization of Special Elements used in an OS Command
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can resu
- 8.4 High severity
mbNET/mbNET.rokey: Improper Validation of Specified Type of Input
A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 9.8 Critical severity
mbNET.mini: Use of Hard-coded Credentials
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
- 7.8 High severity
mbNET.mini: Inadequate Encryption Strength
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.