MYREX24V2 · CVE-2026-60037 · Other
FIX → 2.21.0 ✓ verified
OS command injection (CWE-78) in the frontend device importer of Helmholz myREX24V2/myREX24V2.virtual and MB connect line mbCONNECT24/mymbCONNECT24. An attacker with high privileges (an admin account) can run commands on the server through an OpenSSL call. It is one of 11 CVEs in the same advisories. The vendor rates it CVSS 3.1 7.2 (CERT@VDE CVSS 4.0: 8.6).
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Helmholz myREX24V2 or myREX24V2.virtual, or MB connect line mbCONNECT24 or mymbCONNECT24, below version 2.21.0. Exploiting it needs a high-privileged (admin) login, so the risk is mainly stolen or weak admin credentials, or chaining with the XSS/CSRF issues fixed in the same release. Teams not using these remote-maintenance portals can skip it.
Not affected if version-2.21.0-or-later
Who cares command-injection, helmholz, mbconnect24, mymbconnect24, myrex24v2, openssl, ot, remote-access
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.21.0 are affected (advisories list 2.0.0 up to but not including 2.21.0 in NVD)Upgrade to 2.21.0
Update to version 2.21.0 (vendor remediation in VDE-2026-141 and VDE-2026-079).