Helmholz and MB Connect Line: Account takeover via password reset in multiple products

CVE-2023-0985

What is CVE-2023-0985?

An Authorization Bypass flaw has been identified in MB Connect Lines products including mbCONNECT24, mymbCONNECT24, myREX24, and myREX24.virtual. This vulnerability allows an authenticated remote user with minimal privileges to change passwords for any other user within the same account. Consequently, this can lead to full account takeover, posing significant security risks for users. It is crucial to address this issue to protect sensitive information and maintain system integrity.

References