What’s Vulnerable › Vulnerabilities

CVE-2025-3090: MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-24 · updated 2026-06-17
• Weakness: CWE-306

Description

An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.

Affected products

• Helmholz myREX24: before 2.18.0 — fixed in 2.18.0
• Helmholz myREX24.virtual: before 2.18.0 — fixed in 2.18.0
• MB connect line mbCONNECT24: before 2.18.0 — fixed in 2.18.0
• MB connect line mymbCONNECT24: before 2.18.0 — fixed in 2.18.0

How to fix

Upgrade to a fixed version: Helmholz myREX24 2.18.0; Helmholz myREX24.virtual 2.18.0; MB connect line mbCONNECT24 2.18.0; MB connect line mymbCONNECT24 2.18.0. Check the vendor advisory for mitigations.

References

• https://certvde.com/en/advisories/VDE-2025-034
• https://certvde.com/en/advisories/VDE-2025-037

Get alerted when CVE-2025-3090 or the next vulnerability affects your stack