Critical severity · published Oct 15, 2024
CVE-2024-45275
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mbnet.mini Firmware · Mbconnectline
before 2.3.1 · source: NVD
R1
Rex 100 Firmware · Helmholz
before 2.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45275
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45275
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-056
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2024-066
www.syss.de
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt
More from Rex 100 Firmware
9.8
CVE-2024-45274
An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication
7.8
CVE-2024-45273
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used
7.8
CVE-2024-45271
An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation
7.5
CVE-2024-45276
An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication