CVE-2024-45274

The vulnerability results from the lack of required authentication (CWE-306) for a function accepting commands via UDP. An attacker with network access to the device can send crafted UDP packets containing system commands, which are executed directly by the device's operating system. The attack vector is network-based and does not require user interaction or prior system access.

An attacker can gain full control over the device by executing arbitrary operating system commands, resulting in violations of confidentiality, integrity, and system availability. In the context of industrial devices (industrial gateway/router), this can lead to disruption of operational processes or use of the device as an entry point to the OT network.

Patches available from the manufacturer should be applied according to the references (https://cert.vde.com/en/advisories/VDE-2024-056 and https://cert.vde.com/en/advisories/VDE-2024-066). As a temporary measure, it is recommended to restrict network access to devices through a firewall or network segmentation and block unauthorized UDP traffic to these devices.

Mbconnectline Mbnet.Mini devices (firmware) and Helmholz Rex 100 devices (firmware) — specific versions indicated in the manufacturer's references (CERT VDE advisories VDE-2024-056 and VDE-2024-066)