CVE-2024-45272

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1391

Affected software

Vendor	Product	Versions
MB connect line	mbCONNECT24	>= 0.0.0, <= 2.16.2
MB connect line	mymbCONNECT24	>= 0.0.0, <= 2.16.2
Helmholz	myREX24 V2	>= 0.0.0, <= 2.16.2
Helmholz	myREX24.virtual	>= 0.0.0, <= 2.16.2
mbconnectline	mbconnect24	<= 2.16.2
mbconnectline	mymbconnect24	<= 2.16.2
helmholz	myrex24_v2	<= 2.16.2
helmholz	myrex24.virtual	<= 2.16.2

References

https://cert.vde.com/en/advisories/VDE-2024-068Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-069Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-061.txt

Timeline

Published: Oct 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-452737.8An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of th CVE-2024-452749.8An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.CVE-2024-452759.8The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of CVE-2024-452767.5An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.CVE-2024-452774.3The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker CVE-2024-452785.4SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After su CVE-2024-452796.1Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthe CVE-2024-45284.8A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as problematic. Affected by this vulnerabilit CVE-2024-452804.8Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login applicati CVE-2024-452815.8SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs CVE-2024-452825.3Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The CVE-2024-452836.0SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password