CVE-2020-35565
📋 TL;DR
CVE-2020-35565 is a critical authentication vulnerability in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software where brute-force protection is disabled by default on login pages. This allows attackers to perform unlimited password guessing attempts without rate limiting or lockout mechanisms. All organizations using affected versions of these industrial remote access solutions are vulnerable.
💻 Affected Systems
- MB CONNECT LINE mymbCONNECT24
- MB CONNECT LINE mbCONNECT24
📦 What is this software?
Mbconnect24 by Mbconnectline
Mymbconnect24 by Mbconnectline
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through credential brute-forcing leading to unauthorized access to industrial control systems, potential data theft, and operational disruption.
Likely Case
Successful credential stuffing attacks resulting in unauthorized access to remote management interfaces and potential lateral movement within industrial networks.
If Mitigated
Failed authentication attempts with proper monitoring and alerting, no successful unauthorized access.
🎯 Exploit Status
Exploitation requires only standard HTTP requests to login endpoints with automated password guessing tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.6.2
Vendor Advisory: https://mbconnectline.com/security-advice/
Restart Required: Yes
Instructions:
1. Download latest version from vendor portal. 2. Backup current configuration. 3. Install update following vendor documentation. 4. Verify brute-force protection is enabled in settings.
🔧 Temporary Workarounds
Enable brute-force protection
allManually enable brute-force detection and account lockout features in application settings.
Implement network-level rate limiting
allConfigure firewall or WAF to limit authentication attempts per IP address.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from internet access
- Deploy web application firewall with brute-force protection rules
🔍 How to Verify
Check if Vulnerable:
Check application version in admin interface and verify if version is 2.6.2 or earlier. Test login page with multiple failed attempts to see if lockout occurs.Check Version:
Check version in web interface or consult vendor documentation for version checking method.Verify Fix Applied:
Verify version is above 2.6.2 and test that multiple failed login attempts trigger account lockout or rate limiting.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from same IP address
- Successful login after many failed attempts
- No account lockout events
Network Indicators:
- High volume of POST requests to login endpoints
- Authentication traffic patterns showing brute-force tools
SIEM Query:
source="application_logs" (event="login_failed") | stats count by src_ip | where count > 10