MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the MB connect line mbCONNECT24 and mymbCONNECT24 applications, both in firmware versions through 2.19.3. This vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the server, leading to a full system compromise. It arises from improper handling of special characters in operating system commands, and is considered a variant of the previously reported CVE-2020-10383.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution, resulting in a complete compromise of the affected system.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.19.4.