CVE-2020-35558

moderate-risk
Published 2021-02-16

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.

Do I need to act?

-
0.30% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (4)

Myrex24
Myrex24.Virtual

Affected Vendors

Mbconnectline Helmholz

References (6)

Third Party Advisory https://cert.vde.com/en/advisories/VDE-2021-003
Third Party Advisory https://cert.vde.com/en/advisories/VDE-2022-039
Vendor Advisory https://mbconnectline.com/security-advice/
Third Party Advisory https://cert.vde.com/en/advisories/VDE-2021-003
Third Party Advisory https://cert.vde.com/en/advisories/VDE-2022-039
Vendor Advisory https://mbconnectline.com/security-advice/
37
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 1/34 · Minimal
Exposure 10/34 · Low