MB Connect Line and Helmholz MyREX24V2: Pre-Authentication Blind SQL Injection Vulnerability

A pre-authentication blind SQL injection vulnerability has been identified in the userinfo endpoint's authentication method of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual, all running firmware through 2.19.3. This vulnerability allows unauthenticated remote attackers to exploit improper neutralization of special elements in a SQL SELECT command, leading to arbitrary read access of the complete database.

Impact

Exploitation of this vulnerability allows for unauthenticated blind SQL injection, resulting in arbitrary read access to the entire database.

Remediation

Users are advised to update their mbCONNECT24/mymbCONNECT24 or myREX24V2/myREX24V2.virtual instance to version 2.19.4.