Share: Email | Twitter

ID

VDE-2024-031

Published

2025-03-18 12:00 (CET)

Last update

2025-03-13 16:09 (CET)

Vendor(s)

Helmholz GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
myREX24 V2 < 2.16.2
myREX24.virtual < 2.16.2
REX 200 < 8.2.0
REX 250 < 8.2.0

Summary

The data24 service that is bundled with every installation of myREX24/myREX24.virtual has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.

Vulnerabilities



CVE-2024-23943
9.1
Last Update
March 13, 2025, 3:59 p.m.
Severity
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness
Missing Authentication for Critical Function (CWE-306)
Summary

An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.

Details
cert.vde.com 
CVE-2024-23942
7.1
Last Update
March 13, 2025, 3:59 p.m.
Severity
7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness
Missing Encryption of Sensitive Data (CWE-311)
Summary

A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.

Details
cert.vde.com 

Impact

CVE-2024-23943: A total loss of confidentiality and integrity, for individual devices or the whole service, is possible.

CVE-2024-23942: An attacker in possession of the device's configuration file can impersonate the real device. This also allows to prevent the real device from connecting successful.

Solution

Mitigation

CVE-2024-23942: If the device's serial number is known to mbCONNECT24/mymbCONNECT24 before the downloadable configuration is created, that configuration will be encrypted allowing only the correct device to decrypt it.

Remediation

Update to latest version: 2.16.2

CVE-2024-23943: This fix does not apply to REX 200/REX 250 devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.

Reported by

CERT@VDE coordinated with Helmholz