Improper Access Validation in products of MB connect line and Helmholz

Vulnerability

An access validation flaw exists in MB connect line mymbCONNECT24, mbCONNECT24, and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 [2][3]. The improper use of access validation allows a logged-in user to see devices in the account that they should not have access to.

Exploitation

An attacker needs only a valid user account on the affected portal. No special privileges or network position beyond normal authenticated access are required. The attacker can browse or query device lists that are not scoped to their authorization level, revealing devices belonging to other users or organizations.

Impact

Successful exploitation results in unauthorized disclosure of device identifiers and associated metadata. This information disclosure violates the intended multi-tenancy isolation of the remote access platform, potentially exposing sensitive operational technology (OT) inventory details to unauthorized parties.

Mitigation

The vulnerability is fixed in version 2.12.1 [2][3]. Users should update to this version or later. No workaround is provided in the available references.