Mbconnectline
52 CVEs across 19 Mbconnectline products. Browse Mbconnectline vulnerabilities, severities, and proof-of-concept exploits.
Mbconnectline products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33617 | Medium | 5.3 | 2026-04-02 | An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but ther… |
CVE-2026-33616 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of s… |
CVE-2026-33615 | Critical | 9.1 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special… |
CVE-2026-33614 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special… |
CVE-2026-33613 | High | 7.2 | 2026-04-02 | Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray functi… |
CVE-2025-41681 | Medium | 4.8 | 2025-07-21 | A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. |
CVE-2025-41679 | Medium | 5.3 | 2025-07-21 | An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initia… |
CVE-2025-41678 | Medium | 6.5 | 2025-07-21 | A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL state… |
CVE-2025-41677 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast successio… |
CVE-2025-41676 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. |
CVE-2025-41675 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralizatio… |
CVE-2025-41674 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special el… |
CVE-2025-41673 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elem… |
CVE-2024-45276 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. |
CVE-2024-45275 | Critical | 9.8 | 2024-10-15 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected device… |
CVE-2024-45274 | Critical | 9.8 | 2024-10-15 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. |
CVE-2024-45273 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. |
CVE-2024-45272 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in… |
CVE-2024-45271 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. |
CVE-2023-4834 | Medium | 4.3 | 2023-10-16 | In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validatio… |
CVE-2023-1779 | Medium | 4.3 | 2023-06-06 | Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtu… |
CVE-2023-0985 | High | 8.8 | 2023-06-06 | An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An… |
CVE-2022-22520 | Medium | 5.3 | 2022-09-14 | A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and H… |
CVE-2021-34580 | High | 7.5 | 2021-10-27 | In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted… |
CVE-2021-34575 | High | 7.5 | 2021-08-02 | In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the serv… |
CVE-2021-34574 | Medium | 4.3 | 2021-08-02 | In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the… |
CVE-2021-33527 | Critical | 9.8 | 2021-08-02 | In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM… |
CVE-2021-33526 | High | 7.8 | 2021-08-02 | In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing… |
CVE-2020-12530 | Medium | 4.3 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php all… |
CVE-2020-12529 | Medium | 5.8 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allo… |
CVE-2020-12528 | Medium | 6.5 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a lo… |
CVE-2020-12527 | Medium | 6.5 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access… |
CVE-2020-35570 | Medium | 5.3 | 2021-02-16 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is a… |
CVE-2020-35569 | Medium | 6.1 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page. |
CVE-2020-35568 | Medium | 4.3 | 2021-02-16 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete f… |
CVE-2020-35567 | High | 7.8 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this passw… |
CVE-2020-35566 | Medium | 5.3 | 2021-02-16 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can… |
CVE-2020-35565 | Critical | 9.8 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. |
CVE-2020-35564 | High | 7.5 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user i… |
CVE-2020-35563 | Medium | 5.4 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafte… |
CVE-2020-35561 | Medium | 5.3 | 2021-02-16 | An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF i… |
CVE-2020-35560 | Medium | 6.1 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php. |
CVE-2020-35559 | Medium | 4.3 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to us… |
CVE-2020-35558 | High | 7.5 | 2021-02-16 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the M… |
CVE-2020-35557 | Medium | 6.5 | 2021-02-16 | An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see… |
CVE-2020-24568 | Medium | 6.5 | 2020-10-02 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing… |
CVE-2020-24570 | Medium | 6.5 | 2020-09-30 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module… |
CVE-2020-24569 | Medium | 4.3 | 2020-09-30 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanc… |
CVE-2020-10384 | High | 7.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from… |
CVE-2020-10383 | Critical | 9.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated remote code ex… |
CVE-2020-10382 | High | 8.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code exec… |
CVE-2020-10381 | Medium | 5.3 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated SQL injection… |