CVE-2021-34574

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-669

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-345757.5In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind oCVE-2021-345764.3In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive informatiCVE-2021-345776.5In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while beingCVE-2021-345788.1This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically CVE-2021-345797.5In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on MiCVE-2021-34584.6The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.CVE-2021-345807.5In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the serveCVE-2021-345817.5Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-8CVE-2021-345824.8In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) throughCVE-2021-345837.5Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crashCVE-2021-345849.1Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crasCVE-2021-345857.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not check
CVE-2021-34574: Medium severity, CVSS 4.3 | Vulnix