---
id: "CVE-2026-60038"
page: "https://infrastack.ai/live/CVE-2026-60038"
kind: "vulnerability"
aliases: ["CVE-2026-60038"]
title: "mbCONNECT24 / myREX24 V2: high-privileged user can run code via certificate (PKCS12) import"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "mbCONNECT24", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "mymbCONNECT24", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2.virtual", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["command-injection", "helmholz", "industrial", "infrastructure", "mb-connect-line", "mbconnect24", "mymbconnect24", "myrex24", "openssl", "pkcs12", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T09:17:23+00:00"
first_seen_at: "2026-11-10T09:21:08+00:00"
updated_at: "2026-11-10T09:25:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60038", "first_seen_at": "2026-11-10T09:21:08+00:00"}, {"source": "analyst", "url": "https://certvde.com/en/advisories/VDE-2026-079", "first_seen_at": "2026-11-10T09:25:40+00:00", "cites": ["https://certvde.com/en/advisories/VDE-2026-079", "https://certvde.com/en/advisories/VDE-2026-141/"]}]
exploit_sources: []
---

# mbCONNECT24 / myREX24 V2: high-privileged user can run code via certificate (PKCS12) import

Link for people: https://infrastack.ai/live/CVE-2026-60038 (this .md is for agents)

CERT@VDE advisories VDE-2026-079 and VDE-2026-141 describe a code injection (CWE-78 OS command injection) in the backend ImportPKCS12 function of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual. It needs a high-privileged remote attacker and can lead to code execution. It is not a flaw in the OpenSSL library itself; the advisory only names OpenSSL as what the function uses. CVSS 3.1 is 7.2 per the advisories. No exploitation or PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mbCONNECT24 affected < 2.21.0 fixed 2.21.0
- vendor:mymbCONNECT24 affected < 2.21.0 fixed 2.21.0
- vendor:myREX24V2 affected < 2.21.0 fixed 2.21.0
- vendor:myREX24V2.virtual affected < 2.21.0 fixed 2.21.0

## How to check

Check the version of your mbCONNECT24/mymbCONNECT24/myREX24V2/myREX24V2.virtual instance (admin UI); anything below 2.21.0 is affected. Also review who holds admin accounts on the portal, since exploitation needs high privileges. Hosts running plain OpenSSL do not need to act for this CVE.

## Fix

Update to firmware/version 2.21.0 (mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2.virtual). The advisories list no workarounds.

## Timeline

- 2026-11-10T09:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60038
- 2026-11-10T09:25:40+00:00 analyst https://certvde.com/en/advisories/VDE-2026-079 — Reworded who_affected to drop an unsourced hosted-portal remark.

## Documents

- [advisory] VDE-2026-079 MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24 https://certvde.com/en/advisories/VDE-2026-079
- [advisory] VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual https://certvde.com/en/advisories/VDE-2026-141/

## From the sources

A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_