VDE-2025-065
Last update
07/31/2025 12:00
Published at
07/31/2025 12:00
Vendor(s)
MB connect line GmbH
External ID
VDE-2025-065
CSAF Document
Summary
An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.
Impact
This vulnerability allows an authenticated remote attacker to fully compromise the system by executing arbitrary OS commands.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| MB connect line mbNET HW1 | Firmware <=5.1.11 | |
| MB connect line mbNET/mbNET.rokey | Firmware <7.3.0 |
Vulnerabilities
Expand / Collapse all
Published
09/22/2025 14:57
Severity
Weakness
Improper Isolation or Compartmentalization (CWE-653)
Summary
A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.
References
Remediation
Update mbNET/mbNET.rokey to at least version 7.3.0\
Note: mbNET HW1 is EOL and will not receive any further updates.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 07/31/2025 12:00 | Initial revision. |