Read the docs
TI-2025-02699 Aliases CVE-2025-3090GHSA-675r-p8w7-9hq4

MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24

Priority MEDIUM 42CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00452 39th percentileScored 2026-11-07
Fix Fixed mbCONNECT24 (MB connect line): 2.18.0mymbCONNECT24 (MB connect line): 2.18.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MB connect linembCONNECT24before 2.18.02.18.0Patch availableCNA
MB connect linemymbCONNECT24before 2.18.02.18.0Patch availableCNA
HelmholzmyREX24before 2.18.02.18.0Patch availableCNA
HelmholzmyREX24.virtualbefore 2.18.02.18.0Patch availableCNA
  • mbCONNECT24 VendorMB connect line Affected before 2.18.0 Fixed in 2.18.0 Patch available CNA
  • mymbCONNECT24 VendorMB connect line Affected before 2.18.0 Fixed in 2.18.0 Patch available CNA
  • myREX24 VendorHelmholz Affected before 2.18.0 Fixed in 2.18.0 Patch available CNA
  • myREX24.virtual VendorHelmholz Affected before 2.18.0 Fixed in 2.18.0 Patch available CNA

Remediation

  • Fix · CNA mbCONNECT24 (MB connect line) Fixed in 2.18.0
  • Fix · CNA mymbCONNECT24 (MB connect line) Fixed in 2.18.0
  • Fix · CNA myREX24 (Helmholz) Fixed in 2.18.0
  • Fix · CNA myREX24.virtual (Helmholz) Fixed in 2.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MB connect line mymbCONNECT24 2.18.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-02701 MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24Priority LOW 39
    • TI-2025-02700 MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24Priority LOW 35
    Show all 3 records →
  • Release ·

    Helmholz myREX24, myREX24.virtual 2.18.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-02701 MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24Priority LOW 39
    • TI-2025-02700 MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24Priority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3090
  2. 2026-10-03 Alias added: GHSA-675r-p8w7-9hq4

References

Other 2

  • TI-2024-30346 MB connect line/Helmholz: Remote code execution via confnet service CVSS 3.1CRITICAL 9.8
  • TI-2026-25416 Unauthenticated RCE in com_mb24sysapi CVSS 3.1CRITICAL 9.8
  • TI-2024-30347 MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords CVSS 3.1CRITICAL 9.8
  • TI-2021-12922 OS Command Injection in mbDIALUP <= 3.9R0.0 CVSS 3.1CRITICAL 9.8
  • TI-2024-15924 MB connect line: Cloud API access due to a lack of authentication for a critical function CVSS 3.1CRITICAL 9.1
  • TI-2026-25997 MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint CVSS 3.1CRITICAL 9.1
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences