CVE-2024-45275: Mbnet.mini Auth Bypass Vulnerability

CVE-2024-45275 Overview

CVE-2024-45275 is a critical hardcoded credentials vulnerability affecting industrial VPN routers and remote access devices from mbconnectline and Helmholz. The affected devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker to gain full control of the affected devices. This vulnerability represents a severe security flaw in industrial control system (ICS) environments where these devices are commonly deployed for remote maintenance and monitoring.

Critical Impact

Unauthenticated attackers can leverage hardcoded credentials to gain complete administrative control over affected industrial VPN routers, potentially compromising entire OT/ICS networks and enabling lateral movement to connected industrial systems.

Affected Products

• mbconnectline mbnet.mini firmware
• mbconnectline mbnet.mini hardware
• Helmholz REX 100 firmware
• Helmholz REX 100 hardware

Discovery Timeline

• October 15, 2024 - CVE-2024-45275 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-45275

Vulnerability Analysis

This vulnerability falls under CWE-798 (Use of Hard-coded Credentials), a critical security weakness where authentication credentials are embedded directly into device firmware. The affected mbconnectline mbnet.mini and Helmholz REX 100 devices contain two distinct hardcoded user accounts with static passwords that cannot be changed or disabled by administrators.

The vulnerability allows remote attackers to authenticate to the device management interface without requiring any prior access or authorization. Once authenticated using these hardcoded credentials, attackers gain full administrative privileges over the device, including the ability to modify configurations, intercept traffic, disable security features, and potentially pivot to connected industrial networks.

Industrial VPN routers like the mbnet.mini and REX 100 are commonly deployed at the perimeter of operational technology (OT) networks to enable secure remote access for maintenance and monitoring. Compromise of these devices provides attackers with a strategic foothold for further attacks against connected programmable logic controllers (PLCs), human-machine interfaces (HMIs), and other critical industrial systems.

Root Cause

The root cause of this vulnerability is the inclusion of static, hardcoded user credentials in the device firmware. During the development or manufacturing process, two user accounts with predetermined passwords were embedded into the firmware image. These credentials persist across all deployed devices of the affected models and cannot be removed or modified through standard administrative procedures.

This design flaw likely originated from development or debugging requirements that were never removed before production deployment. The credentials may have been intended for factory testing, firmware recovery, or support access but were inadvertently left active in shipping firmware versions.

Attack Vector

The attack vector for CVE-2024-45275 is network-based and requires no authentication, user interaction, or special privileges. An attacker with network access to the device's management interface can directly authenticate using the known hardcoded credentials.

The exploitation process involves identifying exposed mbnet.mini or REX 100 devices on the network, typically through port scanning or Shodan-style reconnaissance. Once a target device is identified, the attacker connects to the web-based management interface or other administrative services (such as SSH or Telnet if enabled) and authenticates using the publicly known hardcoded username and password combinations.

Successful authentication grants the attacker full administrative control over the device, enabling configuration changes, traffic interception, VPN tunnel manipulation, and access to connected industrial networks. The simplicity of exploitation—requiring only knowledge of the credentials and network access—makes this vulnerability particularly dangerous for internet-exposed devices.

For detailed technical information regarding the specific hardcoded credentials and exploitation methods, refer to the SYSS Advisory SYSS-2024-064.

Detection Methods for CVE-2024-45275

Indicators of Compromise

• Unexpected or unauthorized login events on mbnet.mini or REX 100 device management interfaces
• Authentication logs showing successful logins from unknown IP addresses or geographic locations
• Configuration changes to VPN tunnels, firewall rules, or network settings without administrator action
• Unusual outbound connections from the device to unknown external IP addresses
• New or modified user accounts created on the device

Detection Strategies

• Monitor authentication logs on affected devices for login attempts using the hardcoded account usernames
• Implement network-based intrusion detection rules to identify authentication traffic to device management interfaces from untrusted networks
• Deploy honeypot instances of affected devices to detect active exploitation attempts
• Conduct regular firmware audits to verify devices are running patched versions

Monitoring Recommendations

• Enable detailed logging on all affected devices and forward logs to a centralized SIEM for analysis
• Implement network segmentation monitoring to detect unauthorized traffic crossing OT/IT boundaries
• Configure alerts for any administrative access to affected devices outside of approved maintenance windows
• Perform periodic credential audits and vulnerability scans against industrial network devices

How to Mitigate CVE-2024-45275

Immediate Actions Required

• Immediately restrict network access to affected device management interfaces using firewall rules and network segmentation
• Audit all mbnet.mini and REX 100 deployments to identify vulnerable devices
• Review device logs for evidence of unauthorized access or configuration changes
• Implement additional network-level authentication controls such as VPN requirements or jump hosts for device access

Patch Information

Organizations should apply firmware updates from the respective vendors as soon as they become available. Consult the vendor security advisories for specific patch information:

• VDE Security Advisory VDE-2024-056 - mbconnectline advisory
• VDE Security Advisory VDE-2024-066 - Helmholz advisory

Contact mbconnectline and Helmholz support channels to obtain the latest firmware versions that address CVE-2024-45275. Verify firmware integrity using vendor-provided checksums before deployment.

Workarounds

• Isolate affected devices on dedicated network segments with strict access control lists (ACLs) limiting connectivity to only authorized management systems
• Disable or block all unnecessary management protocols (HTTP/HTTPS, SSH, Telnet) on affected devices until patches can be applied
• Implement network-level authentication using 802.1X or VPN tunnels to add an additional layer of access control before device interfaces
• Deploy network monitoring to detect and alert on any access attempts to affected device management ports

# Example firewall rules to restrict access to device management interface
# Allow management access only from trusted admin network
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 22 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP