CVE-2024-23943

MB connect line: Cloud API access due to a lack of authentication for a critical function

State: Published
Severity: 9.1 Critical
Published: Mar 18, 2025
Updated: Mar 18, 2025
Reserved: Jan 24, 2024

Description

An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CERTVDE

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
mbCONNECT24MB connect line	before 2.16.2Affected
mbNETMB connect line	before 8.2.0Affected
mbNET.rokeyMB connect line	before 8.2.0Affected
mymbCONNECT24MB connect line	before 2.16.2Affected

References

https://cert.vde.com/en/advisories/VDE-2024-010

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.