by Kastro
Paper/Archive/CVE-2024-45275

CVE-2024-45275

MB connect line mbNET.mini — MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.6.566 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

Affected

ProductAffectedFixed inSource
mbNET.mini0.0.0 – 2.2.13–CNA
REX1000.0.0 – 2.2.13–CNA
mbnet.mini≤ 2.2.13–CISA-ADP
rex_100_firmware≤ 2.2.13–CISA-ADP

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2024-056refcert.vde.com/en/advisories/VDE-2024-066refsyss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt