CVE-2025-3091: An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.

PriorityP348high7.5CVSS 3.1

AVNACHPRLUINSUCHIHAH

EPSS

0.32%

24.2th percentile

An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
helmholz	myrex24	< 2.18.0	2.18.0
helmholz	myrex24	< 2.16.5	2.16.5
helmholz	myrex24.virtual	< 2.18.0	2.18.0
helmholz	myrex24.virtual	< 2.16.5	2.16.5
mb_connect_line	mbconnect24	< 2.16.5	2.16.5
mb_connect_line	mymbconnect24	< 2.18.0	2.18.0
mb_connect_line	mymbconnect24	< 2.16.5	2.16.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.