ICS Advisories

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24.

Mitigation summary

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.

Risk evaluation

There is a vulnerability in mbCONNECT24/mymbCONNECT24 that allows an authenticated remote attacker to access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters.

Mitigation summary

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.2.

Risk evaluation

Two command injection vulnerabilities have been discovered in MB connect line mbNET/mbNET.rokey/mbNET.mini.

Mitigation summary

Update: - mbNET/mbNET.rokey: 8.4.5 - mbNET.mini: 3.0.3

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow RCE, SQLi or information leakage.

Mitigation summary

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.

Mitigation summary

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNECT24, mbNET HW1, and mbSPIDER products. CVE-2024-45275 affects only the mbNET HW1 product.

Mitigation summary

**Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbNET.mini product allowing for RCE or unauthorized file access.

Mitigation summary

Update mbNET.mini to the version 2.3.1

Risk evaluation

The data24 service that is bundled with every installation of mbCONNECT24/mymbCONNECT24 has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.

Mitigation summary

Update to latest version: 2.16.2 CVE-2024-23943: This fix does not apply to mbNET/mbNET.rokey devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.

Risk evaluation

An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.

Mitigation summary

Update mbNET/mbNET.rokey to at least version 7.3.0\ **Note**: mbNET HW1 is EOL and will not receive any further updates.

Risk evaluation

Multiple vulnerabilities in all mbNET.mini devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.

Mitigation summary

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Risk evaluation

The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.

Mitigation summary

Update to latest version: 2.18.0

Risk evaluation

Two vulnerabilities in mbCONNECT24/mymbCONNECT24 can lead to user enumeration an password bypass.

Mitigation summary

Update to latest version: 2.16.5

Risk evaluation

Two issues have been discovered in mymbCONNECT24 and mbCONNECT24 in all versionsincluding V2.8.0. Updated affected versions (and solution) due to incomplete fixes in previous versions

Mitigation summary

CVE-2021-34575: Update to 2.9.0 CVE-2021-34574: Update to 2.12.1

Risk evaluation

Two vulnerabilites have been discovered in mbCONNECT24 and mbCONNECT24 in all versions through 2.13.3.

Mitigation summary

If you have MFA enabled on the admin user, the password will still be set, but the attacker will be unable to login as the MFA is still in place.

Risk evaluation

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

Mitigation summary

Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1

Risk evaluation

Multiple issues have been identified in dnsmasq < 2.83

Mitigation summary

Update to the following versions: | Product | Fixed Version | |--------------------|-------------------| | mbNET/mbNET .rokey | >= 7.0.0 | | mbNET HW1 | >= 5.1.11 |

Risk evaluation

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.

Mitigation summary

Update mbCONNECT24/mymbCONNECT24 to 2.10.1

Risk evaluation

Multiple Vulnerabilities in mbConnect24serv (a software service of mbDIALUP) can lead to arbitrary code execution due to improper privilege management. Update A, 2021-11-24 corrected fixed version in solution from 3.9R0.4 to 3.9R0.5 Update B, 2022-03-28 Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

Mitigation summary

Update to 3.9R0.5

Risk evaluation

Two vulnerabilities in mbCONNECT24 and mymbCONNECT24 can lead to information disclosure and arbitrary code execution. Please consult the CVE entries for details.

Mitigation summary

Update to 3.9R0.5

Risk evaluation

There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30 pm  In section Reported by Sebastian Dietz (CyberDanube) was added.

Mitigation summary

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.