description: In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: mbCONNECT24
vendor: Red Lion Europe
versions:
lessThanOrEqual: 2.14.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: mymbCONNECT24
vendor: Red Lion Europe
versions:
lessThanOrEqual: 2.14.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: myREX24
vendor: Helmholz
versions:
lessThanOrEqual: 2.14.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: myREX24.virtual
vendor: Helmholz
versions:
lessThanOrEqual: 2.14.2, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL