CVE-2024-45274 - Vulnerability Details

Vendors	Products
Helmholz	Rex 100 Rex 100 Firmware
Mb Connect Line	Mbnet.mini
Mbconnectline	Mbnet.mini Mbnet.mini Firmware

Link	Providers
https://cert.vde.com/en/advisories/VDE-2024-056
https://cert.vde.com/en/advisories/VDE-2024-066
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-063.txt

Type	Values Removed	Values Added
References		https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-063.txt

Type	Values Removed	Values Added
First Time appeared		Helmholz rex 100 Mbconnectline Mbconnectline mbnet.mini Mbconnectline mbnet.mini Firmware
CPEs		cpe:2.3:h:helmholz:rex_100:-:::::::* cpe:2.3:h:mbconnectline:mbnet.mini:-:::::::* cpe:2.3:o:helmholz:rex_100_firmware:::::::: cpe:2.3:o:mbconnectline:mbnet.mini_firmware::::::::
Vendors & Products		Helmholz rex 100 Mbconnectline Mbconnectline mbnet.mini Mbconnectline mbnet.mini Firmware

Type	Values Removed	Values Added
First Time appeared		Helmholz Helmholz rex 100 Firmware Mb Connect Line Mb Connect Line mbnet.mini
CPEs		cpe:2.3:a:helmholz:rex_100_firmware:::::::: cpe:2.3:a:mb_connect_line:mbnet.mini::::::::
Vendors & Products		Helmholz Helmholz rex 100 Firmware Mb Connect Line Mb Connect Line mbnet.mini
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.
Title		MB connect line/Helmholz: Remote code execution via confnet service
Weaknesses		CWE-306
References		https://cert.vde.com/en/advisories/VDE-2024-056 https://cert.vde.com/en/advisories/VDE-2024-066
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45274", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2024-08-26T09:19:01.266Z", "datePublished": "2024-10-15T10:28:16.384Z", "dateUpdated": "2024-10-16T17:44:15.429Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "mbNET.mini", "vendor": "MB connect line", "versions": [{"lessThanOrEqual": "2.2.13", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "REX100", "vendor": "Helmholz", "versions": [{"lessThanOrEqual": "2.2.13", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Moritz Abrell"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "SySS GmbH"}], "datePublic": "2024-10-15T08:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.<br>"}], "value": "An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2024-10-15T10:28:16.384Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-056"}, {"url": "https://cert.vde.com/en/advisories/VDE-2024-066"}], "source": {"advisory": "VDE-2024-056, VDE-2024-066", "defect": ["CERT@VDE#641679", "CERT@VDE#641692"], "discovery": "UNKNOWN"}, "title": "MB connect line/Helmholz: Remote code execution via confnet service", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "mb_connect_line", "product": "mbnet.mini", "cpes": ["cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.13", "versionType": "semver"}]}, {"vendor": "helmholz", "product": "rex_100_firmware", "cpes": ["cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.13", "versionType": "semver"}]}, {"vendor": "mb_connect_line", "product": "mbnet.mini", "cpes": ["cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.13", "versionType": "semver"}]}, {"vendor": "helmholz", "product": "rex_100_firmware", "cpes": ["cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.13", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T13:33:38.579567Z", "id": "CVE-2024-45274", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:34:58.690Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-10-16T17:44:15.429Z"}, "references": [{"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-063.txt"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-45274 (string)

assignerOrgId : 270ccfa6-a436-4e77-922e-914ec3a9685c (string)

state : PUBLISHED (string)

assignerShortName : CERTVDE (string)

dateReserved : 2024-08-26T09:19:01.266Z (string)

datePublished : 2024-10-15T10:28:16.384Z (string)

dateUpdated : 2024-10-16T17:44:15.429Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : mbNET.mini (string)

vendor : MB connect line (string)

versions : [ »

0 : { »

lessThanOrEqual : 2.2.13 (string)

status : affected (string)

version : 0.0.0 (string)

versionType : semver (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : REX100 (string)

vendor : Helmholz (string)

versions : [ »

0 : { »

lessThanOrEqual : 2.2.13 (string)

status : affected (string)

version : 0.0.0 (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Moritz Abrell (string)

}

1 : { »

lang : en (string)

type : reporter (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : SySS GmbH (string)

}

]

datePublic : 2024-10-15T08:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.<br> (string)

}

]

value : An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-306 (string)

description : CWE-306 Missing Authentication for Critical Function (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 270ccfa6-a436-4e77-922e-914ec3a9685c (string)

shortName : CERTVDE (string)

dateUpdated : 2024-10-15T10:28:16.384Z (string)

}

references : [ »

0 : { »

url : https://cert.vde.com/en/advisories/VDE-2024-056 (string)

}

1 : { »

url : https://cert.vde.com/en/advisories/VDE-2024-066 (string)

}

]

source : { »

advisory : VDE-2024-056, VDE-2024-066 (string)

defect : [ »

0 : CERT@VDE#641679 (string)

1 : CERT@VDE#641692 (string)

]

discovery : UNKNOWN (string)

}

title : MB connect line/Helmholz: Remote code execution via confnet service (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : mb_connect_line (string)

product : mbnet.mini (string)

cpes : [ »

0 : cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 2.2.13 (string)

versionType : semver (string)

}

]

}

1 : { »

vendor : helmholz (string)

product : rex_100_firmware (string)

cpes : [ »

0 : cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 2.2.13 (string)

versionType : semver (string)

}

]

}

2 : { »

vendor : mb_connect_line (string)

product : mbnet.mini (string)

cpes : [ »

0 : cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 2.2.13 (string)

versionType : semver (string)

}

]

}

3 : { »

vendor : helmholz (string)

product : rex_100_firmware (string)

cpes : [ »

0 : cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 2.2.13 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-15T13:33:38.579567Z (string)

id : CVE-2024-45274 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-15T13:34:58.690Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-10-16T17:44:15.429Z (string)

}

references : [ »

0 : { »

url : https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-063.txt (string)

}

]

title : CVE Program Container (string)

x_generator : { »

engine : ADPogram 0.0.1 (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T13:33:38.579567Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*"], "vendor": "mb_connect_line", "product": "mbnet.mini", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*"], "vendor": "helmholz", "product": "rex_100_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:*"], "vendor": "mb_connect_line", "product": "mbnet.mini", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*"], "vendor": "helmholz", "product": "rex_100_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:34:24.468Z"}}], "cna": {"title": "MB connect line/Helmholz: Remote code execution via confnet service", "source": {"defect": ["CERT@VDE#641679", "CERT@VDE#641692"], "advisory": "VDE-2024-056, VDE-2024-066", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Moritz Abrell"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "SySS GmbH"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MB connect line", "product": "mbNET.mini", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}, {"vendor": "Helmholz", "product": "REX100", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}], "datePublic": "2024-10-15T08:00:00.000Z", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-056"}, {"url": "https://cert.vde.com/en/advisories/VDE-2024-066"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2024-10-15T10:28:16.384Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45274", "state": "PUBLISHED", "dateUpdated": "2024-10-15T13:34:58.690Z", "dateReserved": "2024-08-26T09:19:01.266Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2024-10-15T10:28:16.384Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-45274 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-15T13:33:38.579567Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:* (string)

]

vendor : mb_connect_line (string)

product : mbnet.mini (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 2.2.13 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

cpes : [ »

0 : cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : helmholz (string)

product : rex_100_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 2.2.13 (string)

}

]

defaultStatus : unaffected (string)

}

2 : { »

cpes : [ »

0 : cpe:2.3:a:mb_connect_line:mbnet.mini:*:*:*:*:*:*:*:* (string)

]

vendor : mb_connect_line (string)

product : mbnet.mini (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 2.2.13 (string)

}

]

defaultStatus : unaffected (string)

}

3 : { »

cpes : [ »

0 : cpe:2.3:a:helmholz:rex_100_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : helmholz (string)

product : rex_100_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 2.2.13 (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-15T13:34:24.468Z (string)

}

]

cna : { »

title : MB connect line/Helmholz: Remote code execution via confnet service (string)

source : { »

defect : [ »

0 : CERT@VDE#641679 (string)

1 : CERT@VDE#641692 (string)

]

advisory : VDE-2024-056, VDE-2024-066 (string)

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Moritz Abrell (string)

}

1 : { »

lang : en (string)

type : reporter (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : SySS GmbH (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 9.8 (number)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : MB connect line (string)

product : mbNET.mini (string)

versions : [ »

0 : { »

status : affected (string)

version : 0.0.0 (string)

versionType : semver (string)

lessThanOrEqual : 2.2.13 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : Helmholz (string)

product : REX100 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0.0.0 (string)

versionType : semver (string)

lessThanOrEqual : 2.2.13 (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-10-15T08:00:00.000Z (string)

references : [ »

0 : { »

url : https://cert.vde.com/en/advisories/VDE-2024-056 (string)

}

1 : { »

url : https://cert.vde.com/en/advisories/VDE-2024-066 (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-306 (string)

description : CWE-306 Missing Authentication for Critical Function (string)

}

]

}

]

providerMetadata : { »

orgId : 270ccfa6-a436-4e77-922e-914ec3a9685c (string)

shortName : CERTVDE (string)

dateUpdated : 2024-10-15T10:28:16.384Z (string)

}

cveMetadata : { »

cveId : CVE-2024-45274 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-15T13:34:58.690Z (string)

dateReserved : 2024-08-26T09:19:01.266Z (string)

assignerOrgId : 270ccfa6-a436-4e77-922e-914ec3a9685c (string)

datePublished : 2024-10-15T10:28:16.384Z (string)

assignerShortName : CERTVDE (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4E80D53-0907-45AF-A03B-A093C5CEA33B", "versionEndExcluding": "2.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:*", "matchCriteriaId": "A1D1B769-DA91-4F0C-AD34-D735B7A8B8FF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F226166A-1261-43F9-81EC-E1C0FC9CB6E6", "versionEndExcluding": "2.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7E8BE39-3C4A-484A-A34D-3CB4B46E41FA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication."}, {"lang": "es", "value": "Un atacante remoto no autenticado puede ejecutar comandos del sistema operativo a trav\u00e9s de UDP en el dispositivo debido a la falta de autenticaci\u00f3n."}], "id": "CVE-2024-45274", "lastModified": "2024-11-21T09:37:35.617", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2024-10-15T11:15:12.247", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2024-056"}, {"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2024-066"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-063.txt"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "info@cert.vde.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:mbconnectline:mbnet.mini_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E4E80D53-0907-45AF-A03B-A093C5CEA33B (string)

versionEndExcluding : 2.3.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:mbconnectline:mbnet.mini:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A1D1B769-DA91-4F0C-AD34-D735B7A8B8FF (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:helmholz:rex_100_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F226166A-1261-43F9-81EC-E1C0FC9CB6E6 (string)

versionEndExcluding : 2.3.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:helmholz:rex_100:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E7E8BE39-3C4A-484A-A34D-3CB4B46E41FA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. (string)

}

1 : { »

lang : es (string)

value : Un atacante remoto no autenticado puede ejecutar comandos del sistema operativo a través de UDP en el dispositivo debido a la falta de autenticación. (string)

}

]

id : CVE-2024-45274 (string)

lastModified : 2024-11-21T09:37:35.617 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : info@cert.vde.com (string)

type : Secondary (string)

}

]

}

published : 2024-10-15T11:15:12.247 (string)

references : [ »

0 : { »

source : info@cert.vde.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://cert.vde.com/en/advisories/VDE-2024-056 (string)

}

1 : { »

source : info@cert.vde.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://cert.vde.com/en/advisories/VDE-2024-066 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-063.txt (string)

}

]

sourceIdentifier : info@cert.vde.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-306 (string)

}

]

source : info@cert.vde.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object