For awareness Medium Check exposure in your normal cycle
Multiple flaws in mbCONNECT24 and mymbCONNECT24 remote-access services
CERT@VDE advisoriesMB connect line, mbCONNECT24, mymbCONNECT24
What happened. CERT@VDE reports multiple vulnerabilities in MB connect line mbCONNECT24 and mymbCONNECT24. They could allow remote code execution, denial of service or information leakage. The advisory is VDE-2026-079.
Who is affected. Sites using mbCONNECT24 or mymbCONNECT24 from MB connect line for remote access are exposed, because vendors and engineers often reach plant systems this way.
What to do. Check whether you use mbCONNECT24 or mymbCONNECT24 and follow the fix guidance in advisory VDE-2026-079.
When to act. For awareness: mbCONNECT24 users: no exploitation is stated, so check exposure and schedule the fix.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L5
- L3.5
Why: mbCONNECT24 is a remote-access service that links outside engineers to plant networks, so it sits at the industrial DMZ and the internet edge (L3.5, L5).
- Are you exposed?
Search the asset inventory and remote-access contracts for mbCONNECT24 or mymbCONNECT24 accounts and the routers connected to them.
- If you cannot fix it yet
- Limit who can connect through the service and require multi-factor authentication.
- Keep the remote-access path off the plant network until patched.
- Review the service's access logs regularly.
- Watch for
- Remote sessions from unknown accounts or addresses, or outside agreed support hours.
- Repeated failed logons or unexpected service outages on the remote-access platform.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.