| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| mbCONNECT24 | < 2.18.0 | |
| mymbCONNECT24 | < 2.18.0 |
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
Some limited sensitive data can be accessed and a DoS can be performed targeting a specific user/device.
Remediation
Update to latest version: 2.18.0
CERT@VDE coordinated with MB connect line