CVE-2024-45276 Overview
CVE-2024-45276 is a missing authentication vulnerability affecting industrial remote access routers from MB connect line and Helmholz. An unauthenticated remote attacker can read files in the /tmp directory over the network without providing credentials. The flaw is classified as [CWE-306] Missing Authentication for Critical Function and impacts the mbNET.mini and REX 100 firmware product lines, which are used to provide remote maintenance access to industrial machines and control systems.
Critical Impact
Unauthenticated attackers can retrieve sensitive runtime data from the /tmp directory, including session artifacts and configuration fragments that may aid further compromise.
Affected Products
- MB connect line mbNET.mini firmware
- Helmholz REX 100 firmware
- mbNET.mini and REX 100 industrial remote access routers
Discovery Timeline
- 2024-10-15 - CVE-2024-45276 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45276
Vulnerability Analysis
The vulnerability exists in the web-facing services of the mbNET.mini and REX 100 industrial routers. The affected interface exposes read access to files stored in the /tmp directory without enforcing authentication. Any network-reachable client can issue a request and receive file contents that should be restricted to authenticated administrators.
Industrial remote access routers commonly store transient data in /tmp, including upload buffers, log fragments, session tokens, diagnostic output, and intermediate configuration files. Exposing this directory provides attackers with passive reconnaissance opportunities and may leak material useful for subsequent attacks on connected operational technology (OT) networks.
The attack does not require user interaction and can be executed remotely over the network. According to the SYSS Advisory SYSS-2024-065 and VDE Security Advisory VDE-2024-056, exploitation only requires reaching the device's exposed service endpoint.
Root Cause
The root cause is missing authentication enforcement on a critical function. The device firmware fails to verify a valid session or credential before serving file contents from /tmp. This violates the principle that resource-handling endpoints must authenticate requests prior to returning data.
Attack Vector
An attacker reaches the device over the network, sends a request to the affected endpoint, and receives /tmp file contents in the response. No credentials, tokens, or prior access are needed. Devices exposed directly to the internet, or to flat OT network segments accessible from compromised IT systems, are at the highest risk.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. Refer to the VDE Security Advisory VDE-2024-066 for vendor-specific exploitation context.
Detection Methods for CVE-2024-45276
Indicators of Compromise
- Unauthenticated HTTP requests to mbNET.mini or REX 100 web endpoints returning file payloads from /tmp
- Outbound responses from device IP addresses containing file content fragments to untrusted source addresses
- Repeated probing of device management interfaces from external or unexpected internal hosts
Detection Strategies
- Inspect device access logs for requests that retrieved resources without an authenticated session
- Apply network intrusion detection signatures that flag direct access to industrial router management interfaces from outside trusted maintenance networks
- Correlate device traffic with firewall logs to identify scanning behavior targeting mbNET.mini or REX 100 IP ranges
Monitoring Recommendations
- Monitor north-south traffic to OT segments for unsolicited connections to remote access router HTTP/HTTPS services
- Alert on anomalous response sizes from device endpoints that suggest file content disclosure
- Track firmware versions across the fleet and surface devices running versions identified by VDE-2024-056 and VDE-2024-066 as vulnerable
How to Mitigate CVE-2024-45276
Immediate Actions Required
- Identify all mbNET.mini and Helmholz REX 100 devices in the environment and confirm firmware versions against the vendor advisories
- Restrict network access to device management interfaces using firewall rules so that only authorized maintenance hosts can reach them
- Disconnect any affected devices that are directly exposed to the public internet until they are patched
Patch Information
MB connect line and Helmholz have published fixed firmware. Consult VDE Security Advisory VDE-2024-056 for mbNET.mini and VDE Security Advisory VDE-2024-066 for REX 100 to obtain the corrected firmware versions and apply them according to vendor instructions.
Workarounds
- Place affected devices behind a VPN or jump host so that the management plane is not reachable from untrusted networks
- Apply strict access control lists at upstream firewalls or switches to limit which source IPs can contact the device
- Segment OT and IT networks to prevent lateral access from compromised office endpoints to industrial routers
# Configuration example: restrict access to device management interface using iptables
# Replace 192.0.2.10 with the device IP and 10.0.0.0/24 with the authorized maintenance subnet
iptables -A FORWARD -s 10.0.0.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
