CVE-2023-34412
MEDIUMCVSS 4.8/10EPSS 0.34%
Last modified
CVE-2023-34412 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Helmholz | Rex 250 Firmware | < 7.3.2 |
| Helmholz | Rex 200 Firmware | < 7.3.2 |
| Redlion | Mbnet.Rokey Rkh 210 Firmware | < 7.3.2 |
| Redlion | Mbnet.Rokey Rkh 216 Firmware | < 7.3.2 |
| Redlion | Mbnet.Rokey Rkh 235 Firmware | < 7.3.2 |
| Redlion | Mbnet.Rokey Rkh 259 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 811 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 850 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 871 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 831 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 855 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 876 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 858 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 816 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 841 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 859 Firmware | < 7.3.2 |
| Redlion | Mbnet Mdh 835 Firmware | < 7.3.2 |
References
- https://cert.vde.com/en/advisories/VDE-2023-012/Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-029/Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-012/Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-029/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-34412?
A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an
authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
How severe is CVE-2023-34412?
CVE-2023-34412 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 0.34% probability of exploitation in the next 30 days.
How do I fix CVE-2023-34412?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-34407OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0…7.5
- CVE-2023-34408DokuWiki before 2023-04-04a allows XSS via RSS titles.5.4
- CVE-2023-34409In Percona Monitoring and Management (PMM) server 2.x before…9.8
- CVE-2023-3441An issue has been discovered in GitLab EE/CE affecting all v…9.1
- CVE-2023-34410An issue was discovered in Qt before 5.15.15, 6.x before 6.2…5.3
- CVE-2023-34411The xml-rs crate before 0.8.14 for Rust and Crab allows a de…7.5
- CVE-2023-34414The error page for sites with invalid TLS certificates was m…3.1
- CVE-2023-34415When choosing a site-isolated process for a document loaded …6.1
- CVE-2023-34416Memory safety bugs present in Firefox 113, Firefox ESR 102.1…9.8
- CVE-2023-34417Memory safety bugs present in Firefox 113. Some of these bug…9.8
- CVE-2023-34418A valid, authenticated LXCA user may be able to gain unautho…8.1
- CVE-2023-34419A buffer overflow has been identified in the SetupUtility dr…6.7
Are you affected by CVE-2023-34412?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST