MBCONNECT24 · CVE-2026-60038 · Infrastructure
FIX → 2.21.0 ✓ verified
CERT@VDE advisories VDE-2026-079 and VDE-2026-141 describe a code injection (CWE-78 OS command injection) in the backend ImportPKCS12 function of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual. It needs a high-privileged remote attacker and can lead to code execution. It is not a flaw in the OpenSSL library itself; the advisory only names OpenSSL as what the function uses. CVSS 3.1 is 7.2 per the advisories. No exploitation or PoC found.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run MB connect line mbCONNECT24/mymbCONNECT24 or Helmholz myREX24V2/myREX24V2.virtual (industrial remote-maintenance portals) below version 2.21.0. An attacker needs a high-privileged account to reach the certificate (PKCS12) import. Anyone who only uses the OpenSSL library can skip it; the advisories name OpenSSL only as what the function uses.
Not affected if managed-hosting
Who cares command-injection, helmholz, industrial, mb-connect-line, mbconnect24, mymbconnect24, myrex24, openssl, pkcs12, self-hosted
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.21.0 is affectedUpgrade to 2.21.0
2.21.0 (mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2.virtual)