What’s Vulnerable › Vulnerabilities

CVE-2025-3091: MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-24 · updated 2026-06-17
• Weakness: CWE-639

Description

An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.

Affected products

• Helmholz myREX24: before 2.18.0; before 2.16.5 — fixed in 2.16.5, 2.18.0
• Helmholz myREX24.virtual: before 2.18.0; before 2.16.5 — fixed in 2.16.5, 2.18.0
• MB connect line mbCONNECT24: before 2.16.5 — fixed in 2.16.5
• MB connect line mymbCONNECT24: before 2.18.0; before 2.16.5 — fixed in 2.16.5, 2.18.0

How to fix

Upgrade to a fixed version: Helmholz myREX24 2.16.5, 2.18.0; Helmholz myREX24.virtual 2.16.5, 2.18.0; MB connect line mbCONNECT24 2.16.5; MB connect line mymbCONNECT24 2.16.5, 2.18.0. Check the vendor advisory for mitigations.

References

• https://certvde.com/en/advisories/VDE-2025-035
• https://certvde.com/en/advisories/VDE-2025-038

Get alerted when CVE-2025-3091 or the next vulnerability affects your stack