CVE-2023-34412: Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250

Description

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 37% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

R2

REX 200 · Helmholz

before 7.3.2 · source: vendor

R2

REX 250 · Helmholz

before 7.3.2 · source: vendor

MB

mbNET · Red Lion Europe

before 7.3.2 · source: vendor

MB

mbNET.rokey · Red Lion Europe

before 7.3.2 · source: vendor

MM

Mbnet Mdh 811 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 816 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 831 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 835 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 841 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 850 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 855 Firmware · Redlion

before 7.3.2 · source: NVD

MM

Mbnet Mdh 858 Firmware · Redlion

before 7.3.2 · source: NVD