Siemens Mendix Runtime

An attacker could bypass the account lockout protection and repeatedly attempt to guess passwords on Mendix Runtime applications, potentially gaining unauthorized access to systems that control business or operational processes.

Organizations running Mendix Runtime applications should be concerned, particularly those in manufacturing, utilities, or other operational technology environments. Affected users include those running Mendix V8 (unfixable), V9 (vulnerable below 9.24.29), V10 (vulnerable below 10.16.0), V10.6 (vulnerable below 10.6.15), and V10.12 (vulnerable below 10.12.7) with basic authentication enabled.

An attacker on the network can trigger the race condition in the basic authentication mechanism by sending carefully timed authentication requests to the Mendix Runtime service. By exploiting the timing gap, the attacker can circumvent the lockout mechanism that normally blocks login attempts after several failures, allowing unlimited password guessing attempts.