{"id":"CVE-2026-60038","kind":"vulnerability","aliases":["CVE-2026-60038"],"related":[],"title":"mbCONNECT24 / myREX24 V2: high-privileged user can run code via certificate (PKCS12) import","description":"A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.","summary":"CERT@VDE advisories VDE-2026-079 and VDE-2026-141 describe a code injection (CWE-78 OS command injection) in the backend ImportPKCS12 function of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual. It needs a high-privileged remote attacker and can lead to code execution. It is not a flaw in the OpenSSL library itself; the advisory only names OpenSSL as what the function uses. CVSS 3.1 is 7.2 per the advisories. No exploitation or PoC found.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"mymbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["command-injection","helmholz","industrial","infrastructure","mb-connect-line","mbconnect24","mymbconnect24","myrex24","openssl","pkcs12","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the version of your mbCONNECT24/mymbCONNECT24/myREX24V2/myREX24V2.virtual instance (admin UI); anything below 2.21.0 is affected. Also review who holds admin accounts on the portal, since exploitation needs high privileges. Hosts running plain OpenSSL do not need to act for this CVE.","fix":"Update to firmware/version 2.21.0 (mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2.virtual). The advisories list no workarounds.","status":"open","published_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:16+00:00","updated_at":"2026-11-10T09:25:44+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T09:21:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenSSL: a privileged remote attacker can run code via PKCS12 import","impact":"high","summary":"OpenSSL's backend ImportPKCS12 function has a code injection flaw, according to the NVD description. A remote attacker with high privileges can use it to execute code and take full control of the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openssl","pkcs12"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker executes code on the server with full confidentiality and integrity loss","analyst_note":"Check the NVD entry and OpenSSL security advisories for affected versions, fixed versions and whether the PKCS12 import path is reachable by default.","how_to_check":"- unknown","plain_action":"","product_name":"OpenSSL","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":4519,"output_tokens":395,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and OpenSSL security advisories for affected versions, fixed versions and whether the PKCS12 import path is reachable by default.","search":"'-079':48B '-141':52B '-2026':16A,19A,47B,51B '-60038':17A,20A '-78':58B '3.1':110B '7.2':112B 'advisori':45B,100B,115B 'attack':82B,125C 'avail':152C 'backend':64B,134C 'cert':43B 'certif':12A 'code':10A,55B,87B,130C,139C 'command':26B,60B 'command-inject':25B 'confidenti':149C 'connect':33B,69B 'cve':15A,18A 'cvss':109B 'cwe':57B 'describ':53B 'execut':88B,140C 'exploit':117B 'flaw':93B 'found':120B 'function':66B,107B,136C 'helmholz':28B,73B 'high':5A,79B,122C 'high-privileg':4A,78B 'host':42B 'import':14A 'importpkcs12':65B,135C 'industri':29B 'infrastructur':30B 'inject':27B,56B,61B,131C 'integr':150C 'lead':85B,137C 'librari':97B 'line':34B,70B 'loss':147C 'mb':32B,68B 'mb-connect-lin':31B 'mbconnect24':1A,21A,35B 'mbconnect24/mymbconnect24':71B 'mymbconnect24':22A,36B 'myrex24':2A,37B 'myrex24v2':23A 'myrex24v2.virtual':24A 'myrex24v2/myrex24v2.virtual':74B 'name':102B 'need':76B 'openssl':38B,96B,103B,129C 'os':59B 'per':113B 'perform':127C 'pkcs12':13A,39B 'poc':119B 'privileg':6A,80B,123C 'remot':81B,124C 'result':143C 'run':9A 'self':41B 'self-host':40B 'total':146C 'use':108B 'user':7A 'v2':3A 'vde':44B,46B,50B 'via':11A","nicknames":[],"mitigations":[],"who_affected":"Teams that run MB connect line mbCONNECT24/mymbCONNECT24 or Helmholz myREX24V2/myREX24V2.virtual (industrial remote-maintenance portals) below version 2.21.0. An attacker needs a high-privileged account to reach the certificate (PKCS12) import. Anyone who only uses the OpenSSL library can skip it; the advisories name OpenSSL only as what the function uses.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:25:40Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2434},"products":{"at":"2026-11-10T09:25:40Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2434},"how_to_check":{"at":"2026-11-10T09:25:40Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2434},"who_affected":{"at":"2026-11-10T09:25:44Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2434}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mbconnect24","mymbconnect24","myrex24v2","myrex24v2virtual"],"ptokens":["mbconnect24","mymbconnect24","myrex24v2","virtual"],"labels":["commandinjection","helmholz","high","industrial","infrastructure","mbconnect24","mbconnectline","mymbconnect24","myrex24","openssl","pkcs12","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-60038':17A,20A 'certif':12A 'code':10A 'cve':15A,18A 'high':5A 'high-privileg':4A 'import':14A 'mbconnect24':1A,21A 'mymbconnect24':22A 'myrex24':2A 'myrex24v2':23A 'myrex24v2.virtual':24A 'pkcs12':13A 'privileg':6A 'run':9A 'user':7A 'v2':3A 'via':11A","search_b":"'-079':48B '-141':52B '-2026':47B,51B '-78':58B '3.1':110B '7.2':112B 'advisori':45B,100B,115B 'attack':82B 'backend':64B 'cert':43B 'code':55B,87B 'command':26B,60B 'command-inject':25B 'connect':33B,69B 'cvss':109B 'cwe':57B 'describ':53B 'execut':88B 'exploit':117B 'flaw':93B 'found':120B 'function':66B,107B 'helmholz':28B,73B 'high':79B 'high-privileg':78B 'host':42B 'importpkcs12':65B 'industri':29B 'infrastructur':30B 'inject':27B,56B,61B 'lead':85B 'librari':97B 'line':34B,70B 'mb':32B,68B 'mb-connect-lin':31B 'mbconnect24':35B 'mbconnect24/mymbconnect24':71B 'mymbconnect24':36B 'myrex24':37B 'myrex24v2/myrex24v2.virtual':74B 'name':102B 'need':76B 'openssl':38B,96B,103B 'os':59B 'per':113B 'pkcs12':39B 'poc':119B 'privileg':80B 'remot':81B 'self':41B 'self-host':40B 'use':108B 'vde':44B,46B,50B","search_c":"'attack':125C 'avail':152C 'backend':134C 'code':130C,139C 'confidenti':149C 'execut':140C 'function':136C 'high':122C 'importpkcs12':135C 'inject':131C 'integr':150C 'lead':137C 'loss':147C 'openssl':129C 'perform':127C 'privileg':123C 'remot':124C 'result':143C 'total':146C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60038","severity":null,"published_at":"2026-11-10T09:17:23+00:00","modified_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60038:2434","url":"https://certvde.com/en/advisories/VDE-2026-079","severity":null,"published_at":"2026-11-10T09:25:40+00:00","modified_at":"2026-11-10T09:25:44+00:00","first_seen_at":"2026-11-10T09:25:40+00:00","fetched_at":"2026-11-10T09:25:44+00:00","note":"Reworded who_affected to drop an unsourced hosted-portal remark.","cites":["https://certvde.com/en/advisories/VDE-2026-079","https://certvde.com/en/advisories/VDE-2026-141/"]}],"documents":[{"id":114198,"url":"https://certvde.com/en/advisories/VDE-2026-079","title":"VDE-2026-079 MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114179,"url":"https://certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}