CVE-2024-45273: MB connect line/Helmholz: Weak encryption of configuration file

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-15 · updated 2026-06-17
Weakness: CWE-261

Description

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.

Affected products

Helmholz Myrex24 V2 Virtual Server: before 2.16.3 — fixed in 2.16.3
Helmholz Rex 100 Firmware: before 2.3.1 — fixed in 2.3.1
Helmholz Rex 200 Firmware: before 8.2.1 — fixed in 8.2.1
Helmholz Rex 250 Firmware: before 8.2.1 — fixed in 8.2.1
Helmholz Rex 300 Firmware: through 5.1.11
MB connect line mbCONNECT24: before 2.16.3 — fixed in 2.16.3
Mbconnectline Mbnet.Mini Firmware: before 2.3.1 — fixed in 2.3.1
Mbconnectline Mbnet.Rokey Firmware: before 8.2.1 — fixed in 8.2.1
Mbconnectline Mbnet Firmware: before 8.2.1 — fixed in 8.2.1
Mbconnectline Mbnet Hw1 Firmware: through 5.1.11
Mbconnectline Mbspider Mdh 905 Firmware: through 2.6.5
Mbconnectline Mbspider Mdh 906 Firmware: through 2.6.5
Mbconnectline Mbspider Mdh 915 Firmware: through 2.6.5
Mbconnectline Mbspider Mdh 916 Firmware: through 2.6.5
MB connect line mymbCONNECT24: before 2.16.3 — fixed in 2.16.3

How to fix

Upgrade to a fixed version: Helmholz Myrex24 V2 Virtual Server 2.16.3; Helmholz Rex 100 Firmware 2.3.1; Helmholz Rex 200 Firmware 8.2.1; Helmholz Rex 250 Firmware 8.2.1; MB connect line mbCONNECT24 2.16.3; Mbconnectline Mbnet.Mini Firmware 2.3.1; Mbconnectline Mbnet.Rokey Firmware 8.2.1; Mbconnectline Mbnet Firmware 8.2.1; MB connect line mymbCONNECT24 2.16.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-45273 or the next vulnerability affects your stack