Share: Email | Twitter

ID

VDE-2023-043

Published

2023-10-16 10:38 (CEST)

Last update

2023-10-16 10:38 (CEST)

Vendor(s)

Helmholz GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
myREX24 <= 2.14.2
myREX24.virtual <= 2.14.2

CVE ID

CVE-2023-4834 

Last Update:

Aug. 30, 2024, 9:28 a.m.

Severity

4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) 

Weakness

Improper Privilege Management  (CWE-269) 

Summary

In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.

Details

cert.vde.com 

Solution

Update to latest Version 2.14.3

Reported by

OTORIO reported the vulnerabilities to Red Lion Europe.

Red Lion Europe reported the vulnerabilities to Helmholz.

CERT@VDE coordinated.