CVE-2024-45275: MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-15 · updated 2026-06-17
Weakness: CWE-798

Description

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

Affected products

Helmholz Rex 100 Firmware: before 2.3.1 — fixed in 2.3.1
Mbconnectline Mbnet.Mini Firmware: before 2.3.1 — fixed in 2.3.1

How to fix

Upgrade to a fixed version: Helmholz Rex 100 Firmware 2.3.1; Mbconnectline Mbnet.Mini Firmware 2.3.1. Check the vendor advisory for mitigations.

References

https://cert.vde.com/en/advisories/VDE-2024-056
https://cert.vde.com/en/advisories/VDE-2024-066
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt

Get alerted when CVE-2024-45275 or the next vulnerability affects your stack