MYREX24V2 · CVE-2026-60035 · Other
FIX → 2.21.0 ✓ verified
OS command injection (CWE-78) in the backend's network auth function of Helmholz myREX24V2 and myREX24V2.virtual firmware before 2.21.0. A remote attacker with high privileges can execute code; CERT@VDE rates impact as total loss of confidentiality, integrity and availability. Part of VDE-2026-141 (11 CVEs).
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Helmholz myREX24V2 or myREX24V2.virtual remote-access portal firmware older than 2.21.0. The attacker needs a high-privileged (admin) account on the backend, so exposure is greatest where the admin interface is reachable from the network; the same advisory lists XSS/CSRF issues that could help reach that state. Instances already on 2.21.0 can skip it.
Not affected if firmware-2.21.0-or-later
Who cares firmware, helmholz, ics, myrex24v2, remote-access
Check the firmware version of your myREX24V2 or myREX24V2.virtual instance; anything below 2.21.0 is affected.
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.21.0
Update myREX24V2/myREX24V2.virtual to firmware 2.21.0 (per VDE-2026-141).