Vulnerability · Published Mar 18, 2025 · Assigned by CERTVDE
CVE-2024-23942MB connect line: Configuration File on the client workstation is not encrypted
High 7.1
In plain English
A high-severity security flaw in mbCONNECT24 from MB connect line. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.1%top 98.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MB connect line | mbCONNECT24 | 0 – before 2.16.2 |
| MB connect line | mbNET | 0 – before 8.2.0 |
| MB connect line | mbNET.rokey | 0 – before 8.2.0 |
| MB connect line | mymbCONNECT24 | 0 – before 2.16.2 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H