---
id: "CVE-2026-60037"
page: "https://infrastack.ai/live/CVE-2026-60037"
kind: "vulnerability"
aliases: ["CVE-2026-60037"]
title: "Helmholz myREX24V2 and MB connect line mbCONNECT24: OS command injection in device importer (admin required), fixed in 2.21.0"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "myREX24V2", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2.virtual", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}, {"name": "mbCONNECT24", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}, {"name": "mymbCONNECT24", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "helmholz", "mbconnect24", "mymbconnect24", "myrex24v2", "openssl", "ot", "other", "remote-access"]
not_affected_if: ["version-2.21.0-or-later"]
published_at: "2026-11-10T09:17:23+00:00"
first_seen_at: "2026-11-10T09:21:08+00:00"
updated_at: "2026-11-10T09:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60037", "first_seen_at": "2026-11-10T09:21:08+00:00"}, {"source": "analyst", "url": "https://www.certvde.com/en/advisories/VDE-2026-141/", "first_seen_at": "2026-11-10T09:27:15+00:00", "cites": ["https://www.certvde.com/en/advisories/VDE-2026-141/", "https://www.certvde.com/en/advisories/VDE-2026-079/"]}]
exploit_sources: []
---

# Helmholz myREX24V2 and MB connect line mbCONNECT24: OS command injection in device importer (admin required), fixed in 2.21.0

Link for people: https://infrastack.ai/live/CVE-2026-60037 (this .md is for agents)

OS command injection (CWE-78) in the frontend device importer of Helmholz myREX24V2/myREX24V2.virtual and MB connect line mbCONNECT24/mymbCONNECT24. An attacker with high privileges (an admin account) can run commands on the server through an OpenSSL call. It is one of 11 CVEs in the same advisories. The vendor rates it CVSS 3.1 7.2 (CERT@VDE CVSS 4.0: 8.6).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:myREX24V2 affected >= 2.0.0, < 2.21.0 fixed 2.21.0
- vendor:myREX24V2.virtual affected >= 2.0.0, < 2.21.0 fixed 2.21.0
- vendor:mbCONNECT24 affected >= 2.0.0, < 2.21.0 fixed 2.21.0
- vendor:mymbCONNECT24 affected >= 2.0.0, < 2.21.0 fixed 2.21.0

## How to check

Open the admin interface of your myREX24V2, myREX24V2.virtual, mbCONNECT24 or mymbCONNECT24 instance and read the firmware/software version. Versions below 2.21.0 are affected (advisories list 2.0.0 up to but not including 2.21.0 in NVD).

## Fix

Update to version 2.21.0 (vendor remediation in VDE-2026-141 and VDE-2026-079).

## Timeline

- 2026-11-10T09:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60037
- 2026-11-10T09:27:15+00:00 analyst https://www.certvde.com/en/advisories/VDE-2026-141/ — Identified via CERT@VDE advisories VDE-2026-141 (Helmholz) and VDE-2026-079 (MB connect line): remote-access/VPN platform myREX24V2 / mbCONNECT24, fixed in 2.21.0. Not OpenSSL itself. No exploitation or PoC seen; no social search done (low-profile OT CVE).

## Documents

- [advisory] VDE-2026-141 Helmholz myREX24V2/myREX24V2.virtual https://www.certvde.com/en/advisories/VDE-2026-141/
- [advisory] VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24 https://www.certvde.com/en/advisories/VDE-2026-079/

## From the sources

A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_