MB Connect Line and Helmholz myREX24 Products Missing Authentication Vulnerability Allowing Information Disclosure and Denial-of-Service

A vulnerability exists in MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, as well as in Helmholz's myREX24 and myREX24.virtual applications, all versions prior to 2.18.0. The issue arises from the mb24api endpoint, which, when accessed via VPN, lacks proper authentication for sensitive functions. This flaw enables unauthenticated remote attackers to access limited sensitive information, such as user and device names, and to perform denial-of-service attacks targeting specific users or devices.

Impact

Exploitation of this vulnerability allows for unauthorized access to limited sensitive information and the ability to disrupt service for a specific user or device.

Remediation

Users are advised to update to the latest version, 2.18.0.