Vulnerability-Lookup

CVE-2024-45275 (GCVE-0-2024-45275)

Vulnerability from cvelistv5 – Published: 2024-10-15 10:28 – Updated: 2024-10-16 17:39

Title

MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords

Summary

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 13:31 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

CERTVDE icscert root

References

3 references

URL	Tags
https://cert.vde.com/en/advisories/VDE-2024-056
https://cert.vde.com/en/advisories/VDE-2024-066
https://www.syss.de/fileadmin/dokumente/Publikati…

Impacted products

4 products

Vendor	Product	Version	CPE status
MB connect line	mbNET.mini	Affected: 0.0.0 , ≤ 2.2.13 (semver)	guessed
Helmholz	REX100	Affected: 0.0.0 , ≤ 2.2.13 (semver)	guessed
mb_connect_line	mbnet.mini	Affected: 0 , ≤ 2.2.13 (semver) cpe:2.3:a:mb_connect_line:mbnet.mini::::::::
helmholz	rex_100_firmware	Affected: 0 , ≤ 2.2.13 (semver) cpe:2.3:a:helmholz:rex_100_firmware::::::::

Date Public

2024-10-15 08:00

Credits

Moritz Abrell SySS GmbH

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "mbnet.mini",
            "vendor": "mb_connect_line",
            "versions": [
              {
                "lessThanOrEqual": "2.2.13",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "rex_100_firmware",
            "vendor": "helmholz",
            "versions": [
              {
                "lessThanOrEqual": "2.2.13",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45275",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T13:31:57.475980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T13:33:13.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-16T17:39:58.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mbNET.mini",
          "vendor": "MB connect line",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "REX100",
          "vendor": "Helmholz",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Moritz Abrell"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "SySS GmbH"
        }
      ],
      "datePublic": "2024-10-15T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.\u003cbr\u003e"
            }
          ],
          "value": "The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T10:28:37.223Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2024-056"
        },
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2024-066"
        }
      ],
      "source": {
        "advisory": "VDE-2024-056, VDE-2024-066",
        "defect": [
          "CERT@VDE#641679",
          "CERT@VDE#641692"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2024-45275",
    "datePublished": "2024-10-15T10:28:37.223Z",
    "dateReserved": "2024-08-26T09:19:01.266Z",
    "dateUpdated": "2024-10-16T17:39:58.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45275",
      "date": "2026-09-15",
      "epss": "0.008",
      "percentile": "0.54619"
    },
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.1\", \"matchCriteriaId\": \"E4E80D53-0907-45AF-A03B-A093C5CEA33B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1D1B769-DA91-4F0C-AD34-D735B7A8B8FF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.1\", \"matchCriteriaId\": \"F226166A-1261-43F9-81EC-E1C0FC9CB6E6\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E7E8BE39-3C4A-484A-A34D-3CB4B46E41FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.\"}, {\"lang\": \"es\", \"value\": \"Los dispositivos contienen dos cuentas de usuario codificadas con contrase\\u00f1as codificadas que permiten a un atacante remoto no autenticado tener control total de los dispositivos afectados.\"}]",
      "id": "CVE-2024-45275",
      "lastModified": "2024-11-21T09:37:35.750",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@cert.vde.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-10-15T11:15:12.487",
      "references": "[{\"url\": \"https://cert.vde.com/en/advisories/VDE-2024-056\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert.vde.com/en/advisories/VDE-2024-066\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "info@cert.vde.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"info@cert.vde.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45275\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2024-10-15T11:15:12.487\",\"lastModified\":\"2026-06-17T07:53:55.903\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.\"},{\"lang\":\"es\",\"value\":\"Los dispositivos contienen dos cuentas de usuario codificadas con contrase\u00f1as codificadas que permiten a un atacante remoto no autenticado tener control total de los dispositivos afectados.\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"MB connect line\",\"product\":\"mbNET.mini\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0\",\"lessThanOrEqual\":\"2.2.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Helmholz\",\"product\":\"REX100\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0.0.0\",\"lessThanOrEqual\":\"2.2.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"mb_connect_line\",\"product\":\"mbnet.mini\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2.2.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"helmholz\",\"product\":\"rex_100_firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2.2.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-15T13:31:57.475980Z\",\"id\":\"CVE-2024-45275\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.1\",\"matchCriteriaId\":\"E4E80D53-0907-45AF-A03B-A093C5CEA33B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1D1B769-DA91-4F0C-AD34-D735B7A8B8FF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.1\",\"matchCriteriaId\":\"F226166A-1261-43F9-81EC-E1C0FC9CB6E6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E8BE39-3C4A-484A-A34D-3CB4B46E41FA\"}]}]}],\"references\":[{\"url\":\"https://cert.vde.com/en/advisories/VDE-2024-056\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert.vde.com/en/advisories/VDE-2024-066\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T19:49:30+00:00",
      "cve": "CVE-2024-45275",
      "id": "CVE-2024-45275",
      "initial_release_date": "2024-10-15T08:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45275.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt\"}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-10-16T17:39:58.106Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45275\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T13:31:57.475980Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*\"], \"vendor\": \"mb_connect_line\", \"product\": \"mbnet.mini\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.2.13\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"helmholz\", \"product\": \"rex_100_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.2.13\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T13:33:06.534Z\"}}], \"cna\": {\"title\": \"MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords\", \"source\": {\"defect\": [\"CERT@VDE#641679\", \"CERT@VDE#641692\"], \"advisory\": \"VDE-2024-056, VDE-2024-066\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Moritz Abrell\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"SySS GmbH\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"MB connect line\", \"product\": \"mbNET.mini\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.2.13\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Helmholz\", \"product\": \"REX100\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.2.13\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-10-15T08:00:00.000Z\", \"references\": [{\"url\": \"https://cert.vde.com/en/advisories/VDE-2024-056\"}, {\"url\": \"https://cert.vde.com/en/advisories/VDE-2024-066\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798 Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2024-10-15T10:28:37.223Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45275\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-16T17:39:58.106Z\", \"dateReserved\": \"2024-08-26T09:19:01.266Z\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"datePublished\": \"2024-10-15T10:28:37.223Z\", \"assignerShortName\": \"CERTVDE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-45275

Vulnerability from fkie_nvd - Published: 2024-10-15 11:15 - Updated: 2026-06-17 07:53

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

References

URL	Tags
info@cert.vde.com	https://cert.vde.com/en/advisories/VDE-2024-056	Third Party Advisory
info@cert.vde.com	https://cert.vde.com/en/advisories/VDE-2024-066	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt

Impacted products

Vendor	Product	Version
mbconnectline	mbnet.mini_firmware	*
mbconnectline	mbnet.mini	-
helmholz	rex_100_firmware	*
helmholz	rex_100	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "mbNET.mini",
          "vendor": "MB connect line",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "REX100",
          "vendor": "Helmholz",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "info@cert.vde.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "mbnet.mini",
          "vendor": "mb_connect_line",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "rex_100_firmware",
          "vendor": "helmholz",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4E80D53-0907-45AF-A03B-A093C5CEA33B",
              "versionEndExcluding": "2.3.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1D1B769-DA91-4F0C-AD34-D735B7A8B8FF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F226166A-1261-43F9-81EC-E1C0FC9CB6E6",
              "versionEndExcluding": "2.3.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7E8BE39-3C4A-484A-A34D-3CB4B46E41FA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices."
    },
    {
      "lang": "es",
      "value": "Los dispositivos contienen dos cuentas de usuario codificadas con contrase\u00f1as codificadas que permiten a un atacante remoto no autenticado tener control total de los dispositivos afectados."
    }
  ],
  "id": "CVE-2024-45275",
  "lastModified": "2026-06-17T07:53:55.903",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45275",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-15T13:31:57.475980Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-15T11:15:12.487",
  "references": [
    {
      "source": "info@cert.vde.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en/advisories/VDE-2024-056"
    },
    {
      "source": "info@cert.vde.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en/advisories/VDE-2024-066"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-064.txt"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GWQP-V8M6-GJCC

Vulnerability from github – Published: 2024-10-15 12:30 – Updated: 2024-10-15 12:30

Details

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45275"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-15T11:15:12Z",
    "severity": "CRITICAL"
  },
  "details": "The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.",
  "id": "GHSA-gwqp-v8m6-gjcc",
  "modified": "2024-10-15T12:30:37Z",
  "published": "2024-10-15T12:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45275"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2024-056"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2024-066"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

VDE-2024-056

Vulnerability from csaf_mbconnectlinegmbh - Published: 2024-10-15 08:00 - Updated: 2025-08-27 10:00

Summary

MB connect line: Multiple Vulnerabilities in mbNET.mini Product

Scope

5 vulnerabilities in this advisory, including CVE-2024-45275.

CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known affected: 1 product

Open the full advisory

VDE-2024-068

Vulnerability from csaf_mbconnectlinegmbh - Published: 2024-10-15 08:00 - Updated: 2026-03-06 08:00

Summary

MB connect line: Multiple Vulnerabilities in MB connect line Products

Scope

3 vulnerabilities in this advisory, including CVE-2024-45275.

CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product Last affected: 1 product

Open the full advisory

VDE-2024-066

Vulnerability from csaf_helmholzgmbhcokg - Published: 2024-10-15 08:00 - Updated: 2025-08-27 10:00

Summary

Helmholz: Multiple Vulnerabilities in Helmholz REX100 Product

Scope

5 vulnerabilities in this advisory, including CVE-2024-45275.

CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known affected: 1 product

Open the full advisory

VDE-2024-069

Vulnerability from csaf_helmholzgmbhcokg - Published: 2024-10-15 08:00 - Updated: 2026-03-06 08:00

Summary

Helmholz: Multiple Vulnerabilities in Helmholz products

Scope

3 vulnerabilities in this advisory, including CVE-2024-45275.

CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product Last affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-45275 (GCVE-0-2024-45275)

FKIE_CVE-2024-45275

GHSA-GWQP-V8M6-GJCC

VDE-2024-056

VDE-2024-068

VDE-2024-066

VDE-2024-069

Tags

Sightings

Nomenclature

Related by attack behaviour