CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert.vde.com/en/advisories/VDE-2024-056	Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-066	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:*

History

17 Oct 2024, 17:39

Type	Values Removed	Values Added
First Time		Helmholz Helmholz rex 100 Helmholz rex 100 Firmware Mbconnectline mbnet.mini Firmware Mbconnectline mbnet.mini Mbconnectline
Summary		(es) Los dispositivos contienen dos cuentas de usuario codificadas con contraseñas codificadas que permiten a un atacante remoto no autenticado tener control total de los dispositivos afectados.
References	~~() https://cert.vde.com/en/advisories/VDE-2024-056 -~~	() https://cert.vde.com/en/advisories/VDE-2024-056 - Third Party Advisory
References	~~() https://cert.vde.com/en/advisories/VDE-2024-066 -~~	() https://cert.vde.com/en/advisories/VDE-2024-066 - Third Party Advisory
CPE		cpe:2.3:h:helmholz:rex_100:-:::::::* cpe:2.3:h:mbconnectline:mbnet.mini:-:::::::* cpe:2.3:o:mbconnectline:mbnet.mini_firmware:::::::: cpe:2.3:o:helmholz:rex_100_firmware::::::::

15 Oct 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-15 11:15

Updated : 2024-10-17 17:39

NVD link : CVE-2024-45275

Mitre link : CVE-2024-45275

CVE.ORG link : CVE-2024-45275

JSON object : View

Products Affected

helmholz

rex_100
rex_100_firmware

mbconnectline

mbnet.mini
mbnet.mini_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2024-45275", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-10-15T11:15:12.487", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-056", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}, {"url": "https://cert.vde.com/en/advisories/VDE-2024-066", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices."}, {"lang": "es", "value": "Los dispositivos contienen dos cuentas de usuario codificadas con contrase\u00f1as codificadas que permiten a un atacante remoto no autenticado tener control total de los dispositivos afectados."}], "lastModified": "2024-10-17T17:39:52.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4E80D53-0907-45AF-A03B-A093C5CEA33B", "versionEndExcluding": "2.3.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1D1B769-DA91-4F0C-AD34-D735B7A8B8FF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F226166A-1261-43F9-81EC-E1C0FC9CB6E6", "versionEndExcluding": "2.3.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E7E8BE39-3C4A-484A-A34D-3CB4B46E41FA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "info@cert.vde.com"}