MB Connect Line mbCONNECT24 and mymbCONNECT24 RCE Vulnerability

A remote code execution vulnerability has been identified in the MB Connect Line mbCONNECT24 and mymbCONNECT24 applications, specifically in the generateSrpArray function. This vulnerability arises from improper handling of special characters in an operating system command, allowing remote attackers to execute arbitrary code and potentially compromise the entire system. Exploitation of this vulnerability requires an existing method to write arbitrary data to the user table.

Impact

Exploitation of this vulnerability allows for remote code execution, leading to a complete compromise of the affected system.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.19.5.