ICS-Advisories

Risk Evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24.

Zusammenfassung der Gegenmaßnahmen

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.

Risk Evaluation

There is a vulnerability in mbCONNECT24/mymbCONNECT24 that allows an authenticated remote attacker to access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters.

Zusammenfassung der Gegenmaßnahmen

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.2.

Risk Evaluation

Two command injection vulnerabilities have been discovered in MB connect line mbNET/mbNET.rokey/mbNET.mini.

Zusammenfassung der Gegenmaßnahmen

Update: - mbNET/mbNET.rokey: 8.4.5 - mbNET.mini: 3.0.3

Risk Evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow RCE, SQLi or information leakage.

Zusammenfassung der Gegenmaßnahmen

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.

Risk Evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.

Zusammenfassung der Gegenmaßnahmen

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.

Risk Evaluation

Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNECT24, mbNET HW1, and mbSPIDER products. CVE-2024-45275 affects only the mbNET HW1 product.

Zusammenfassung der Gegenmaßnahmen

**Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.

Risk Evaluation

Multiple vulnerabilities have been discovered in MB connect line mbNET.mini product allowing for RCE or unauthorized file access.

Zusammenfassung der Gegenmaßnahmen

Update mbNET.mini to the version 2.3.1

Risk Evaluation

The data24 service that is bundled with every installation of mbCONNECT24/mymbCONNECT24 has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.16.2 CVE-2024-23943: This fix does not apply to mbNET/mbNET.rokey devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.

Risk Evaluation

An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.

Zusammenfassung der Gegenmaßnahmen

Update mbNET/mbNET.rokey to at least version 7.3.0\ **Note**: mbNET HW1 is EOL and will not receive any further updates.

Risk Evaluation

Multiple vulnerabilities in all mbNET.mini devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.

Zusammenfassung der Gegenmaßnahmen

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Risk Evaluation

The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.18.0

Risk Evaluation

Two vulnerabilities in mbCONNECT24/mymbCONNECT24 can lead to user enumeration an password bypass.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.16.5

Risk Evaluation

Two issues have been discovered in mymbCONNECT24 and mbCONNECT24 in all versionsincluding V2.8.0. Updated affected versions (and solution) due to incomplete fixes in previous versions

Zusammenfassung der Gegenmaßnahmen

CVE-2021-34575: Update to 2.9.0 CVE-2021-34574: Update to 2.12.1

Risk Evaluation

Two vulnerabilites have been discovered in mbCONNECT24 and mbCONNECT24 in all versions through 2.13.3.

Zusammenfassung der Gegenmaßnahmen

If you have MFA enabled on the admin user, the password will still be set, but the attacker will be unable to login as the MFA is still in place.

Risk Evaluation

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

Zusammenfassung der Gegenmaßnahmen

Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1

Risk Evaluation

Multiple issues have been identified in dnsmasq < 2.83

Zusammenfassung der Gegenmaßnahmen

Update to the following versions: | Product | Fixed Version | |--------------------|-------------------| | mbNET/mbNET .rokey | >= 7.0.0 | | mbNET HW1 | >= 5.1.11 |

Risk Evaluation

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.

Zusammenfassung der Gegenmaßnahmen

Update mbCONNECT24/mymbCONNECT24 to 2.10.1

Risk Evaluation

Multiple Vulnerabilities in mbConnect24serv (a software service of mbDIALUP) can lead to arbitrary code execution due to improper privilege management. Update A, 2021-11-24 corrected fixed version in solution from 3.9R0.4 to 3.9R0.5 Update B, 2022-03-28 Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

Zusammenfassung der Gegenmaßnahmen

Update to 3.9R0.5

Risk Evaluation

Two vulnerabilities in mbCONNECT24 and mymbCONNECT24 can lead to information disclosure and arbitrary code execution. Please consult the CVE entries for details.

Zusammenfassung der Gegenmaßnahmen

Update to 3.9R0.5

Risk Evaluation

There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30 pm  In section Reported by Sebastian Dietz (CyberDanube) was added.

Zusammenfassung der Gegenmaßnahmen

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.