What’s Vulnerable › Vulnerabilities

CVE-2024-45272: MB connect line/Helmholz: Generation of weak passwords vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-15 · updated 2026-06-17
• Weakness: CWE-1391

Description

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.

Affected products

• Helmholz Myrex24 V2 Virtual Server: before 2.16.3 — fixed in 2.16.3
• Helmholz Rex 200 Firmware: before 8.2.1 — fixed in 8.2.1
• Helmholz Rex 250 Firmware: before 8.2.1 — fixed in 8.2.1
• Helmholz Rex 300 Firmware: through 5.1.11
• MB connect line mbCONNECT24: before 2.16.3 — fixed in 2.16.3
• Mbconnectline Mbnet.Rokey Firmware: before 8.2.1 — fixed in 8.2.1
• Mbconnectline Mbnet Firmware: before 8.2.1 — fixed in 8.2.1
• Mbconnectline Mbnet Hw1 Firmware: through 5.1.11
• Mbconnectline Mbspider Mdh 905 Firmware: through 2.6.5
• Mbconnectline Mbspider Mdh 906 Firmware: through 2.6.5
• Mbconnectline Mbspider Mdh 915 Firmware: through 2.6.5
• Mbconnectline Mbspider Mdh 916 Firmware: through 2.6.5
• MB connect line mymbCONNECT24: before 2.16.3 — fixed in 2.16.3

How to fix

Upgrade to a fixed version: Helmholz Myrex24 V2 Virtual Server 2.16.3; Helmholz Rex 200 Firmware 8.2.1; Helmholz Rex 250 Firmware 8.2.1; MB connect line mbCONNECT24 2.16.3; Mbconnectline Mbnet.Rokey Firmware 8.2.1; Mbconnectline Mbnet Firmware 8.2.1; MB connect line mymbCONNECT24 2.16.3. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en/advisories/VDE-2024-068
• https://cert.vde.com/en/advisories/VDE-2024-069
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-061.txt

Get alerted when CVE-2024-45272 or the next vulnerability affects your stack