CVE-2021-34580 - CVE House

Status published High CVE-2021-34580

Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0

7.5 CVSS

Vulnerability Description

In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34580

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

LEWA Attendorn GmbH reported the vulnerability to MB connect line. CERT@VDE coordinated.

References

https://cert.vde.com/en/advisories/VDE-2021-037/

More from MB connect line

View All →

CVE-2025-41688

High Privilege RCE via LUA Sandbox Escape

High 7.2

CVE-2025-41681

Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input

Medium 4.8

CVE-2025-41679

Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service

Medium 5.3

CVE-2025-41678

SQL Injection via POST Requests Allowing Configuration Database Manipulation

Medium 6.5

CVE-2025-41677

Resource Exhaustion via POST Requests to send-mail Action

Medium 4.9

Affected Vendor

MB connect line

View all reports →

Affected Software

mymbCONNECT24, mbCONNECT24

Vulnerable Versions:

2.9.0

Timeline

Official Publish: October 27th, 2021

Last Modified: September 17th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-204

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.