{"id":"CVE-2026-60039","kind":"vulnerability","aliases":["CVE-2026-60039"],"related":[],"title":"mbCONNECT24 / myREX24V2: OS command injection in backend backup restore (fixed in 2.21.0)","description":"A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.","summary":"A high-privileged remote user of the mbCONNECT24/mymbCONNECT24 (MB connect line) or myREX24V2/myREX24V2.virtual (Helmholz) backend can inject OS commands through the backup restore function, leading to code execution (CWE-78). Vendor CVSS 3.1 is 7.2; fixed in 2.21.0.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"mymbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["backup-restore","command-injection","industrial","mbconnect24","mymbconnect24","myrex24v2","ot","other","self-hosted"],"not_affected_if":["managed-hosting","version-2.21.0-or-later"],"how_to_check":"Check the firmware/software version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance (admin backend). Anything below 2.21.0 is affected per the vendor advisories.","fix":"Update the instance to version 2.21.0 (per VDE-2026-079 and VDE-2026-141).","status":"open","published_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:16+00:00","updated_at":"2026-11-10T09:25:37+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T09:21:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Backend backup restore function allows code injection by privileged remote attacker","impact":"high","summary":"A remote attacker with high privileges can inject code through the backend's backup restore function. Successful exploitation leads to code execution, with full loss of confidentiality, integrity and availability.","audience":"businesses","category":"other","nicknames":[],"who_cares":["backup-restore"],"confidence":0.3,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the server and takes it fully over","analyst_note":"Identify the affected product and its backup restore component from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60039 and find fixed versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":4500,"output_tokens":368,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and its backup restore component from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60039 and find fixed versions.","search":"'-2026':14A,17A '-60039':15A,18A '-78':68B '2.21.0':12A,76B '3.1':71B '7.2':73B 'attack':81C 'avail':108C 'backend':7A,53B,89C 'backup':8A,24B,60B,90C 'backup-restor':23B 'code':65B,85C,95C 'command':4A,27B,57B 'command-inject':26B 'confidenti':105C 'connect':48B 'cve':13A,16A 'cvss':70B 'cwe':67B 'execut':66B,96C 'fix':10A,74B 'function':62B,92C 'helmholz':52B 'high':40B,78C 'high-privileg':39B 'host':37B 'industri':29B 'inject':5A,28B,55B,86C 'integr':106C 'lead':63B,93C 'line':49B 'loss':103C 'mb':47B 'mbconnect24':1A,19A,30B 'mbconnect24/mymbconnect24':46B 'mymbconnect24':20A,31B 'myrex24v2':2A,21A,32B 'myrex24v2.virtual':22A 'myrex24v2/myrex24v2.virtual':51B 'os':3A,56B 'ot':33B 'perform':83C 'privileg':41B,79C 'remot':42B,80C 'restor':9A,25B,61B,91C 'result':99C 'self':36B 'self-host':35B 'total':102C 'user':43B 'vendor':69B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-managed mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance older than 2.21.0 (industrial remote-maintenance portals). Exploitation needs a high-privileged (admin) backend account; the same advisories list a CSRF (CVE-2026-60041) and XSS (CVE-2026-60043) that can make a logged-in backend user restore an uploaded backup. Users of a hosted portal that the vendor updates centrally need to confirm with their provider.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:25:37Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-141/","run_id":2433},"products":{"at":"2026-11-10T09:25:37Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-141/","run_id":2433},"how_to_check":{"at":"2026-11-10T09:25:37Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-141/","run_id":2433},"who_affected":{"at":"2026-11-10T09:25:37Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-141/","run_id":2433}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mbconnect24","mymbconnect24","myrex24v2","myrex24v2virtual"],"ptokens":["mbconnect24","mymbconnect24","myrex24v2","virtual"],"labels":["backuprestore","commandinjection","high","industrial","mbconnect24","mymbconnect24","myrex24v2","ot","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-60039':15A,18A '2.21.0':12A 'backend':7A 'backup':8A 'command':4A 'cve':13A,16A 'fix':10A 'inject':5A 'mbconnect24':1A,19A 'mymbconnect24':20A 'myrex24v2':2A,21A 'myrex24v2.virtual':22A 'os':3A 'restor':9A","search_b":"'-78':68B '2.21.0':76B '3.1':71B '7.2':73B 'backend':53B 'backup':24B,60B 'backup-restor':23B 'code':65B 'command':27B,57B 'command-inject':26B 'connect':48B 'cvss':70B 'cwe':67B 'execut':66B 'fix':74B 'function':62B 'helmholz':52B 'high':40B 'high-privileg':39B 'host':37B 'industri':29B 'inject':28B,55B 'lead':63B 'line':49B 'mb':47B 'mbconnect24':30B 'mbconnect24/mymbconnect24':46B 'mymbconnect24':31B 'myrex24v2':32B 'myrex24v2/myrex24v2.virtual':51B 'os':56B 'ot':33B 'privileg':41B 'remot':42B 'restor':25B,61B 'self':36B 'self-host':35B 'user':43B 'vendor':69B","search_c":"'attack':81C 'avail':108C 'backend':89C 'backup':90C 'code':85C,95C 'confidenti':105C 'execut':96C 'function':92C 'high':78C 'inject':86C 'integr':106C 'lead':93C 'loss':103C 'perform':83C 'privileg':79C 'remot':80C 'restor':91C 'result':99C 'total':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60039","severity":null,"published_at":"2026-11-10T09:17:23+00:00","modified_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60039:2433","url":"https://www.certvde.com/en/advisories/VDE-2026-079/","severity":null,"published_at":"2026-11-10T09:25:37+00:00","modified_at":"2026-11-10T09:25:37+00:00","first_seen_at":"2026-11-10T09:25:37+00:00","fetched_at":"2026-11-10T09:25:37+00:00","note":"Primary: CERT@VDE VDE-2026-079 (MB connect line) and VDE-2026-141 (Helmholz): <2.21.0 affected, update to 2.21.0; vendor CVSS 3.1 7.2 (NVD v4 8.6). No exploitation or PoC found. No community posts searched (brand-new, low-profile ICS advisory). Severity left as is.","cites":["https://www.certvde.com/en/advisories/VDE-2026-079/","https://www.certvde.com/en/advisories/VDE-2026-141/"]}],"documents":[{"id":114194,"url":"https://www.certvde.com/en/advisories/VDE-2026-079/","title":"VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114195,"url":"https://www.certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}