---
id: "CVE-2026-60040"
page: "https://infrastack.ai/live/CVE-2026-60040"
kind: "vulnerability"
aliases: ["CVE-2026-60040"]
title: "MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2: unauthenticated attacker can crash the backup creation function"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "mbCONNECT24", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "mymbCONNECT24", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2.virtual", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["backend", "backup", "dos", "helmholz", "industrial", "mb-connect-line", "mbconnect24", "mymbconnect24", "myrex24", "other", "remote-access", "unauthenticated"]
not_affected_if: ["firmware-2.21.0-or-later", "not-internet-exposed"]
published_at: "2026-11-10T09:17:23+00:00"
first_seen_at: "2026-11-10T09:21:08+00:00"
updated_at: "2026-11-10T09:25:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60040", "first_seen_at": "2026-11-10T09:21:08+00:00"}, {"source": "analyst", "url": "https://www.certvde.com/en/advisories/VDE-2026-079/", "first_seen_at": "2026-11-10T09:25:46+00:00", "cites": ["https://www.certvde.com/en/advisories/VDE-2026-079/", "https://www.certvde.com/en/advisories/VDE-2026-141/"]}]
exploit_sources: []
---

# MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2: unauthenticated attacker can crash the backup creation function

Link for people: https://infrastack.ai/live/CVE-2026-60040 (this .md is for agents)

An unauthenticated remote attacker can cause a denial of service in the backup creation function of the web backend (CWE-770, resource allocation without limits). Vendor advisories rate it 7.5 (CVSS 3.1) with total loss of availability. Fixed in firmware 2.21.0. No exploitation or PoC is reported in the advisories.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mbCONNECT24 affected < 2.21.0 fixed 2.21.0
- vendor:mymbCONNECT24 affected < 2.21.0 fixed 2.21.0
- vendor:myREX24V2 affected < 2.21.0 fixed 2.21.0
- vendor:myREX24V2.virtual affected < 2.21.0 fixed 2.21.0

## How to check

Check the firmware version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance. Anything below 2.21.0 is affected. Also check whether the web interface is reachable from the Internet.

## Fix

Update the instance to firmware 2.21.0 or later (the vendor's remediation).

## Timeline

- 2026-11-10T09:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60040
- 2026-11-10T09:25:46+00:00 analyst https://www.certvde.com/en/advisories/VDE-2026-079/ — Read CERT@VDE VDE-2026-079 (MB connect line) and VDE-2026-141 (Helmholz): firmware <2.21.0 affected, update to 2.21.0. Same advisories cover 11 sibling CVEs (CVE-2026-60035..60046). No exploitation/PoC found. NVD page returned empty; CVSS 8.7 is the v4 score from CNA, advisory says 7.5 v3.1.

## Documents

- [advisory] VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24 https://www.certvde.com/en/advisories/VDE-2026-079/
- [advisory] VDE-2026-141 Helmholz myREX24V2/myREX24V2.virtual https://www.certvde.com/en/advisories/VDE-2026-141/

## From the sources

An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_