MB Connect Line mbCONNECT24 and mymbCONNECT24 Unencrypted Sensitive Data Vulnerability Allowing Impersonation and Denial-of-Service

A vulnerability exists in MB connect line's mbCONNECT24 and mymbCONNECT24 services, affecting versions prior to 2.16.2. A local user may discover an unencrypted configuration file containing sensitive data on the client workstation. This exposure allows an attacker to impersonate the device or disrupt its connection to the cloud portal, causing a denial-of-service.

Impact

Exploitation of this vulnerability enables an attacker to impersonate the device whose configuration file has been accessed. This impersonation can disrupt the device's connection to the cloud portal, leading to a denial-of-service.

Remediation

Users can update to the latest version, 2.16.2, to address this vulnerability. For mbNET and mbNET.rokey devices with firmware versions 8.0.0 to 8.1.3, the update should be to version 8.2.0 or later.