{"id":"CVE-2026-60041","kind":"vulnerability","aliases":["CVE-2026-60041"],"related":[],"title":"CSRF in mbCONNECT24 and Helmholz myREX24V2 admin backend can shut down the server or restore a backup","description":"An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.","summary":"A CSRF flaw in the backend of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual (firmware below 2.21.0) lets a malicious page make a logged-in backend user shut down the server or restore an uploaded backup. Fixed in 2.21.0.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"mymbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["admin-panel","csrf","helmholz","ics","mbconnect24","mymbconnect24","myrex24v2","other","remote-access","web-backend"],"not_affected_if":["firmware-2.21.0-or-later","unknown"],"how_to_check":"Check the firmware version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance; anything below 2.21.0 is affected.","fix":"Update to firmware 2.21.0","status":"open","published_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","triaged_at":"2026-11-10T09:21:20+00:00","updated_at":"2026-11-10T09:25:13+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T09:21:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cross-site request forgery lets attackers shut down servers and restore backups","impact":"high","summary":"An unauthenticated attacker can trick a logged-in backend administrator into running critical system actions through a cross-site request forgery attack. The sources say an attacker could shut down the server or restore an uploaded backup, causing loss of integrity and availability.","audience":"businesses","category":"other","nicknames":[],"who_cares":["web-backend","admin-panel"],"confidence":0.3,"fix_status":"unknown","needs_auth":"no","worst_case":"server shut down and uploaded backup restored by attacker","analyst_note":"Identify the affected product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60041, then find its fixed versions and checks.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources do not name the affected product, so this cannot be tied to a specific system. Teams running a web backend with a logged-in administrator console should review whether that console accepts state-changing requests without anti-forgery protection.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4540,"output_tokens":448,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60041, then find its fixed versions and checks.","search":"'-2026':19A,22A '-60041':20A,23A '2.21.0':60B,83B 'access':40B 'action':106C 'admin':7A,29B 'admin-panel':28B 'allow':99C,109C 'attack':87C,92C,111C 'avail':130C 'backend':8A,43B,49B,70B,97C 'backup':17A,80B,120C 'connect':52B 'could':108C 'critic':104C 'csrf':1A,31B,45B,91C 'cve':18A,21A 'execut':101C 'firmwar':58B 'fix':81B 'flaw':46B 'helmholz':5A,32B,56B 'ic':33B 'integr':128C 'let':61B 'line':53B 'log':68B,95C 'logged-in':67B 'loss':126C 'make':65B 'malici':63B 'mb':51B 'mbconnect24':3A,24A,34B 'mbconnect24/mymbconnect24':54B 'multipl':103C 'mymbconnect24':25A,35B 'myrex24v2':6A,26A,36B 'myrex24v2.virtual':27A 'myrex24v2/myrex24v2.virtual':57B 'page':64B 'panel':30B 'perform':89C 'remot':39B,86C 'remote-access':38B 'restor':15A,77B,117C 'result':123C 'server':13A,75B,115C 'shut':10A,72B 'shutdown':113C 'system':105C 'unauthent':85C 'upload':79B,119C 'user':71B,98C 'web':42B 'web-backend':41B","nicknames":[],"mitigations":[],"who_affected":"Anyone running MB connect line mbCONNECT24/mymbCONNECT24 or Helmholz myREX24V2/myREX24V2.virtual remote-access portals on firmware below 2.21.0. An attacker needs a logged-in backend user to visit a malicious page. Instances on 2.21.0 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:25:13Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2431},"products":{"at":"2026-11-10T09:25:13Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2431},"how_to_check":{"at":"2026-11-10T09:25:13Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2431},"who_affected":{"at":"2026-11-10T09:25:13Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2431}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mbconnect24","mymbconnect24","myrex24v2","myrex24v2virtual"],"ptokens":["mbconnect24","mymbconnect24","myrex24v2","virtual"],"labels":["adminpanel","csrf","helmholz","high","ics","mbconnect24","mymbconnect24","myrex24v2","other","remoteaccess","webbackend"],"campaign_type":null,"search_a":"'-2026':19A,22A '-60041':20A,23A 'admin':7A 'backend':8A 'backup':17A 'csrf':1A 'cve':18A,21A 'helmholz':5A 'mbconnect24':3A,24A 'mymbconnect24':25A 'myrex24v2':6A,26A 'myrex24v2.virtual':27A 'restor':15A 'server':13A 'shut':10A","search_b":"'2.21.0':60B,83B 'access':40B 'admin':29B 'admin-panel':28B 'backend':43B,49B,70B 'backup':80B 'connect':52B 'csrf':31B,45B 'firmwar':58B 'fix':81B 'flaw':46B 'helmholz':32B,56B 'ic':33B 'let':61B 'line':53B 'log':68B 'logged-in':67B 'make':65B 'malici':63B 'mb':51B 'mbconnect24':34B 'mbconnect24/mymbconnect24':54B 'mymbconnect24':35B 'myrex24v2':36B 'myrex24v2/myrex24v2.virtual':57B 'page':64B 'panel':30B 'remot':39B 'remote-access':38B 'restor':77B 'server':75B 'shut':72B 'upload':79B 'user':71B 'web':42B 'web-backend':41B","search_c":"'action':106C 'allow':99C,109C 'attack':87C,92C,111C 'avail':130C 'backend':97C 'backup':120C 'could':108C 'critic':104C 'csrf':91C 'execut':101C 'integr':128C 'log':95C 'loss':126C 'multipl':103C 'perform':89C 'remot':86C 'restor':117C 'result':123C 'server':115C 'shutdown':113C 'system':105C 'unauthent':85C 'upload':119C 'user':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60041","severity":null,"published_at":"2026-11-10T09:17:23+00:00","modified_at":"2026-11-10T09:17:23+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","fetched_at":"2026-11-10T09:21:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60041:2431","url":"https://certvde.com/en/advisories/VDE-2026-079/","severity":null,"published_at":"2026-11-10T09:25:13+00:00","modified_at":"2026-11-10T09:25:13+00:00","first_seen_at":"2026-11-10T09:25:13+00:00","fetched_at":"2026-11-10T09:25:13+00:00","note":"CERT@VDE VDE-2026-079 and VDE-2026-141 name affected products and fix 2.21.0. No exploitation or PoC seen; did not search social.","cites":["https://certvde.com/en/advisories/VDE-2026-079/","https://certvde.com/en/advisories/VDE-2026-141/"]}],"documents":[{"id":114178,"url":"https://certvde.com/en/advisories/VDE-2026-079/","title":"VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114179,"url":"https://certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}