MB connect line vulnerabilities
We track 46 vulnerabilities in MB connect line products across 9 products. 46 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest MB connect line vulnerabilities
- 9.1 Critical severity
mbCONNECT24: Missing Authentication for Critical Functionality
An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.
- 7.1 High severity
mbCONNECT24: Cleartext Storage of Sensitive Information
A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.
- 9.8 Critical severity
mbNET.mini: Use of Hard-coded Credentials
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
- 7.8 High severity
mbNET.mini: Inadequate Encryption Strength
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
- 7.5 High severity
mbCONNECT24: Use of Weak Credentials
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
- 8.8 High severity
mbCONNECT24: Authorization Bypass Through User-Controlled Key
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account