{"api_version":"1","generated_at":"2026-07-23T11:37:50+00:00","cve":"CVE-2020-35559","urls":{"html":"https://cve.report/CVE-2020-35559","api":"https://cve.report/api/cve/CVE-2020-35559.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-35559","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-35559"},"summary":{"title":"CVE-2020-35559","description":"An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-02-16 16:15:00","updated_at":"2021-02-19 20:11:00"},"problem_types":["CWE-400"],"metrics":[],"references":[{"url":"https://cert.vde.com/de-de/advisories/vde-2021-003","name":"https://cert.vde.com/de-de/advisories/vde-2021-003","refsource":"MISC","tags":["Third Party Advisory"],"title":"MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 <= 2.6.2 — German (Germany)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://mbconnectline.com/security-advice/","name":"https://mbconnectline.com/security-advice/","refsource":"MISC","tags":["Vendor Advisory"],"title":"Security Advice - MB connect line GmbH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35559","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35559","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"35559","vulnerable":"1","versionEndIncluding":"2.6.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mbconnectline","cpe5":"mbconnect24","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"35559","vulnerable":"1","versionEndIncluding":"2.6.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mbconnectline","cpe5":"mymbconnect24","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-35559","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://mbconnectline.com/security-advice/","refsource":"MISC","name":"https://mbconnectline.com/security-advice/"},{"refsource":"MISC","name":"https://cert.vde.com/de-de/advisories/vde-2021-003","url":"https://cert.vde.com/de-de/advisories/vde-2021-003"}]}},"nvd":{"publishedDate":"2021-02-16 16:15:00","lastModifiedDate":"2021-02-19 20:11:00","problem_types":["CWE-400"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"35559","Ordinal":"195064","Title":"CVE-2020-35559","CVE":"CVE-2020-35559","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"35559","Ordinal":"1","NoteData":"An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"35559","Ordinal":"2","NoteData":"2021-02-16","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"35559","Ordinal":"3","NoteData":"2021-02-16","Type":"Other","Title":"Modified"}]}}}