MBCONNECT24 · CVE-2026-60041 · Other
FIX → 2.21.0 ✓ verified
A CSRF flaw in the backend of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual (firmware below 2.21.0) lets a malicious page make a logged-in backend user shut down the server or restore an uploaded backup. Fixed in 2.21.0.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running MB connect line mbCONNECT24/mymbCONNECT24 or Helmholz myREX24V2/myREX24V2.virtual remote-access portals on firmware below 2.21.0. An attacker needs a logged-in backend user to visit a malicious page. Instances on 2.21.0 or later can skip it.
Not affected if firmware-2.21.0-or-later, unknown
Who cares admin-panel, csrf, helmholz, ics, mbconnect24, mymbconnect24, myrex24v2, remote-access, web-backend
Check the firmware version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance; anything below is affected.
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.21.0Upgrade to 2.21.0
Update to firmware 2.21.0