CVE-2021-34574

MEDIUM

mbconnect24 and mymbconnect24 < 2.11.2 - Authenticated Password Policy Bypass via Request Interception

Title source: llm
STIX 2.1

Description

In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_confirm
https://cert.vde.com/en/advisories/VDE-2022-039
Third Party Advisory x_refsource_confirm
https://cert.vde.com/en/advisories/VDE-2021-030

Scores

CVSS v3 4.3
EPSS 0.0066
EPSS Percentile 46.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-669
Status published
Products (4)
helmholz/myrex24 < 2.11.2
helmholz/myrex24.virtual < 2.11.2
mbconnectline/mbconnect24 < 2.11.2
mbconnectline/mymbconnect24 < 2.11.2
Published Aug 02, 2021
Tracked Since Feb 18, 2026