{"id":"CVE-2026-60037","kind":"vulnerability","aliases":["CVE-2026-60037"],"related":[],"title":"Helmholz myREX24V2 and MB connect line mbCONNECT24: OS command injection in device importer (admin required), fixed in 2.21.0","description":"A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.","summary":"OS command injection (CWE-78) in the frontend device importer of Helmholz myREX24V2/myREX24V2.virtual and MB connect line mbCONNECT24/mymbCONNECT24. An attacker with high privileges (an admin account) can run commands on the server through an OpenSSL call. It is one of 11 CVEs in the same advisories. The vendor rates it CVSS 3.1 7.2 (CERT@VDE CVSS 4.0: 8.6).","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"myREX24V2","fixed":["2.21.0"],"affected":">= 2.0.0, < 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":">= 2.0.0, < 2.21.0","ecosystem":"vendor"},{"name":"mbCONNECT24","fixed":["2.21.0"],"affected":">= 2.0.0, < 2.21.0","ecosystem":"vendor"},{"name":"mymbCONNECT24","fixed":["2.21.0"],"affected":">= 2.0.0, < 2.21.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","helmholz","mbconnect24","mymbconnect24","myrex24v2","openssl","ot","other","remote-access"],"not_affected_if":["version-2.21.0-or-later"],"how_to_check":"Open the admin interface of your myREX24V2, myREX24V2.virtual, mbCONNECT24 or mymbCONNECT24 instance and read the firmware/software version. Versions below 2.21.0 are affected (advisories list 2.0.0 up to but not including 2.21.0 in NVD).","fix":"Update to version 2.21.0 (vendor remediation in VDE-2026-141 and VDE-2026-079).","status":"open","published_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:17+00:00","updated_at":"2026-11-10T09:27:15+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T09:21:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Xen-style frontends device importer allows code injection via OpenSSL, high privilege","impact":"high","summary":"A remote attacker with high privileges can inject code through the frontends device importer function, which the description links to OpenSSL. Successful exploitation leads to code execution with total loss of confidentiality, integrity and availability.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openssl"],"confidence":0.3,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs with full control: confidentiality, integrity and availability all lost.","analyst_note":"Sources give only the NVD description; identify the affected product (the frontends device importer appears to be in a hypervisor or appliance, not OpenSSL itself), affected versions and any fix at https://nvd.nist.gov/vuln/detail/CVE-2026-60037.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4509,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; identify the affected product (the frontends device importer appears to be in a hypervisor or appliance, not OpenSSL itself), affected versions and any fix at https://nvd.nist.gov/vuln/detail/CVE-2026-60037.","search":"'-2026':20A,23A '-60037':21A,24A '-78':46B '11':82B '2.21.0':18A '3.1':93B '4.0':98B '7.2':94B '8.6':99B 'access':41B 'account':67B 'admin':14A,66B 'advisori':87B 'attack':61B,104C 'avail':132C 'call':77B 'cert':95B 'code':109C,119C 'command':9A,30B,43B,70B 'command-inject':29B 'confidenti':129C 'connect':5A,57B 'cve':19A,22A 'cves':83B 'cvss':92B,97B 'cwe':45B 'devic':12A,50B,114C 'execut':120C 'fix':16A 'frontend':49B,113C 'function':116C 'helmholz':1A,32B,53B 'high':63B,101C 'import':13A,51B,115C 'inject':10A,31B,44B,110C 'integr':130C 'lead':117C 'line':6A,58B 'loss':127C 'mb':4A,56B 'mbconnect24':7A,27A,33B 'mbconnect24/mymbconnect24':59B 'mymbconnect24':28A,34B 'myrex24v2':2A,25A,35B 'myrex24v2.virtual':26A 'myrex24v2/myrex24v2.virtual':54B 'one':80B 'openssl':36B,76B,108C 'os':8A,42B 'ot':37B 'perform':106C 'privileg':64B,102C 'rate':90B 'remot':40B,103C 'remote-access':39B 'requir':15A 'result':123C 'run':69B 'server':73B 'total':126C 'vde':96B 'vendor':89B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Helmholz myREX24V2 or myREX24V2.virtual, or MB connect line mbCONNECT24 or mymbCONNECT24, below version 2.21.0. Exploiting it needs a high-privileged (admin) login, so the risk is mainly stolen or weak admin credentials, or chaining with the XSS/CSRF issues fixed in the same release. Teams not using these remote-maintenance portals can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:27:15Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-079/","run_id":2435},"products":{"at":"2026-11-10T09:27:15Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-079/","run_id":2435},"how_to_check":{"at":"2026-11-10T09:27:15Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-079/","run_id":2435},"who_affected":{"at":"2026-11-10T09:27:15Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-079/","run_id":2435}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mbconnect24","mymbconnect24","myrex24v2","myrex24v2virtual"],"ptokens":["mbconnect24","mymbconnect24","myrex24v2","virtual"],"labels":["commandinjection","helmholz","high","mbconnect24","mymbconnect24","myrex24v2","openssl","ot","other","remoteaccess"],"campaign_type":null,"search_a":"'-2026':20A,23A '-60037':21A,24A '2.21.0':18A 'admin':14A 'command':9A 'connect':5A 'cve':19A,22A 'devic':12A 'fix':16A 'helmholz':1A 'import':13A 'inject':10A 'line':6A 'mb':4A 'mbconnect24':7A,27A 'mymbconnect24':28A 'myrex24v2':2A,25A 'myrex24v2.virtual':26A 'os':8A 'requir':15A","search_b":"'-78':46B '11':82B '3.1':93B '4.0':98B '7.2':94B '8.6':99B 'access':41B 'account':67B 'admin':66B 'advisori':87B 'attack':61B 'call':77B 'cert':95B 'command':30B,43B,70B 'command-inject':29B 'connect':57B 'cves':83B 'cvss':92B,97B 'cwe':45B 'devic':50B 'frontend':49B 'helmholz':32B,53B 'high':63B 'import':51B 'inject':31B,44B 'line':58B 'mb':56B 'mbconnect24':33B 'mbconnect24/mymbconnect24':59B 'mymbconnect24':34B 'myrex24v2':35B 'myrex24v2/myrex24v2.virtual':54B 'one':80B 'openssl':36B,76B 'os':42B 'ot':37B 'privileg':64B 'rate':90B 'remot':40B 'remote-access':39B 'run':69B 'server':73B 'vde':96B 'vendor':89B","search_c":"'attack':104C 'avail':132C 'code':109C,119C 'confidenti':129C 'devic':114C 'execut':120C 'frontend':113C 'function':116C 'high':101C 'import':115C 'inject':110C 'integr':130C 'lead':117C 'loss':127C 'openssl':108C 'perform':106C 'privileg':102C 'remot':103C 'result':123C 'total':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60037","severity":null,"published_at":"2026-11-10T09:17:23+00:00","modified_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60037:2435","url":"https://www.certvde.com/en/advisories/VDE-2026-141/","severity":null,"published_at":"2026-11-10T09:27:15+00:00","modified_at":"2026-11-10T09:27:15+00:00","first_seen_at":"2026-11-10T09:27:15+00:00","fetched_at":"2026-11-10T09:27:15+00:00","note":"Identified via CERT@VDE advisories VDE-2026-141 (Helmholz) and VDE-2026-079 (MB connect line): remote-access/VPN platform myREX24V2 / mbCONNECT24, fixed in 2.21.0. Not OpenSSL itself. No exploitation or PoC seen; no social search done (low-profile OT CVE).","cites":["https://www.certvde.com/en/advisories/VDE-2026-141/","https://www.certvde.com/en/advisories/VDE-2026-079/"]}],"documents":[{"id":114195,"url":"https://www.certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114194,"url":"https://www.certvde.com/en/advisories/VDE-2026-079/","title":"VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}