{"id":"CVE-2026-60035","kind":"vulnerability","aliases":["CVE-2026-60035"],"related":[],"title":"Helmholz myREX24V2: OS command injection in backend network auth function (admin required), fixed in 2.21.0","description":"A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.","summary":"OS command injection (CWE-78) in the backend's network auth function of Helmholz myREX24V2 and myREX24V2.virtual firmware before 2.21.0. A remote attacker with high privileges can execute code; CERT@VDE rates impact as total loss of confidentiality, integrity and availability. Part of VDE-2026-141 (11 CVEs).","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"myREX24V2","fixed":["2.21.0"],"affected":"firmware < 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":"firmware < 2.21.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","helmholz","ics","myrex24v2","other","remote-access"],"not_affected_if":["firmware-2.21.0-or-later"],"how_to_check":"Check the firmware version of your myREX24V2 or myREX24V2.virtual instance; anything below 2.21.0 is affected.","fix":"Update myREX24V2/myREX24V2.virtual to firmware 2.21.0 (per VDE-2026-141).","status":"open","published_at":"2026-11-10T09:17:22+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:19+00:00","updated_at":"2026-11-10T09:27:16+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T09:21:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Backends network auth function allows code injection by a privileged remote attacker","impact":"high","summary":"A remote attacker with high privileges can inject code into the backends network authentication function. Successful exploitation leads to code execution with total loss of confidentiality, integrity and availability.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code and takes total control of the system","analyst_note":"Identify the affected product from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-60035); the description does not name the product, versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00062,"input_tokens":4499,"output_tokens":341,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-60035); the description does not name the product, versions or fix.","search":"'-141':77B '-2026':17A,20A,76B '-60035':18A,21A '-78':36B '11':78B '2.21.0':15A,51B 'access':31B 'admin':11A 'attack':54B,84C 'auth':9A,42B,94C 'avail':72B,111C 'backend':7A,39B,92C 'cert':61B 'code':60B,88C,98C 'command':4A,33B 'confidenti':69B,108C 'cve':16A,19A 'cves':79B 'cwe':35B 'execut':59B,99C 'firmwar':24B,49B 'fix':13A 'function':10A,43B,95C 'helmholz':1A,25B,45B 'high':56B,81C 'ic':26B 'impact':64B 'inject':5A,34B,89C 'integr':70B,109C 'lead':96C 'loss':67B,106C 'myrex24v2':2A,22A,27B,46B 'myrex24v2.virtual':23A,48B 'network':8A,41B,93C 'os':3A,32B 'part':73B 'perform':86C 'privileg':57B,82C 'rate':63B 'remot':30B,53B,83C 'remote-access':29B 'requir':12A 'result':102C 'total':66B,105C 'vde':62B,75B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Helmholz myREX24V2 or myREX24V2.virtual remote-access portal firmware older than 2.21.0. The attacker needs a high-privileged (admin) account on the backend, so exposure is greatest where the admin interface is reachable from the network; the same advisory lists XSS/CSRF issues that could help reach that state. Instances already on 2.21.0 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:27:16Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2437},"products":{"at":"2026-11-10T09:27:16Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2437},"how_to_check":{"at":"2026-11-10T09:27:16Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2437},"who_affected":{"at":"2026-11-10T09:27:16Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2437}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["myrex24v2","myrex24v2virtual"],"ptokens":["myrex24v2","virtual"],"labels":["firmware","helmholz","high","ics","myrex24v2","other","remoteaccess"],"campaign_type":null,"search_a":"'-2026':17A,20A '-60035':18A,21A '2.21.0':15A 'admin':11A 'auth':9A 'backend':7A 'command':4A 'cve':16A,19A 'fix':13A 'function':10A 'helmholz':1A 'inject':5A 'myrex24v2':2A,22A 'myrex24v2.virtual':23A 'network':8A 'os':3A 'requir':12A","search_b":"'-141':77B '-2026':76B '-78':36B '11':78B '2.21.0':51B 'access':31B 'attack':54B 'auth':42B 'avail':72B 'backend':39B 'cert':61B 'code':60B 'command':33B 'confidenti':69B 'cves':79B 'cwe':35B 'execut':59B 'firmwar':24B,49B 'function':43B 'helmholz':25B,45B 'high':56B 'ic':26B 'impact':64B 'inject':34B 'integr':70B 'loss':67B 'myrex24v2':27B,46B 'myrex24v2.virtual':48B 'network':41B 'os':32B 'part':73B 'privileg':57B 'rate':63B 'remot':30B,53B 'remote-access':29B 'total':66B 'vde':62B,75B","search_c":"'attack':84C 'auth':94C 'avail':111C 'backend':92C 'code':88C,98C 'confidenti':108C 'execut':99C 'function':95C 'high':81C 'inject':89C 'integr':109C 'lead':96C 'loss':106C 'network':93C 'perform':86C 'privileg':82C 'remot':83C 'result':102C 'total':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60035","severity":null,"published_at":"2026-11-10T09:17:22+00:00","modified_at":"2026-11-10T09:17:22+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60035:2437","url":"https://certvde.com/en/advisories/VDE-2026-141/","severity":null,"published_at":"2026-11-10T09:27:16+00:00","modified_at":"2026-11-10T09:27:16+00:00","first_seen_at":"2026-11-10T09:27:16+00:00","fetched_at":"2026-11-10T09:27:16+00:00","note":"Identified via CERT@VDE VDE-2026-141 (Helmholz myREX24V2); CVSS 3.1 7.2, no exploitation or PoC checked beyond advisory. Advisory read directly.","cites":["https://certvde.com/en/advisories/VDE-2026-141/"]}],"documents":[{"id":114179,"url":"https://certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}