CVE-2023-4834

Vulnerability

An improperly implemented access validation exists in Red Lion Europe mbCONNECT24, mymbCONNECT24, Helmholz myREX24, and myREX24.virtual up to and including version 2.14.2 [1][2]. This allows authenticated users with low privileges to gain unauthorized read access to limited, non-critical device information that should be restricted to their account.

Exploitation

An attacker with a low-privileged account can exploit this vulnerability by requesting device information endpoints that lack proper authorization checks [1][2]. No additional privileges or user interaction beyond authentication are required.

Impact

Successful exploitation gives the attacker read access to limited, non-critical device information [1][2]. The data is restricted to non-sensitive details and does not include critical configuration or operational parameters. No modification or escalation of privilege is possible.

Mitigation

As of publication, the vendor has not released a fixed version [1][2]. Users should monitor vendor advisories for updates. No workarounds are currently available.