---
id: "CVE-2026-60043"
page: "https://infrastack.ai/live/CVE-2026-60043"
kind: "vulnerability"
aliases: ["CVE-2026-60043"]
title: "XSS in mbCONNECT24 and myREX24V2 admin backend lets attacker shut down server or restore a backup (fixed in 2.21.0)"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "mbCONNECT24", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "mymbCONNECT24", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2.virtual", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["industrial", "mbconnect24", "mymbconnect24", "myrex24v2", "other", "remote-access", "self-hosted", "web-admin-panel", "xss"]
not_affected_if: []
published_at: "2026-11-10T09:17:24+00:00"
first_seen_at: "2026-11-10T09:21:09+00:00"
updated_at: "2026-11-10T09:23:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60043", "first_seen_at": "2026-11-10T09:21:09+00:00"}, {"source": "analyst", "url": "https://certvde.com/en/advisories/VDE-2026-079/", "first_seen_at": "2026-11-10T09:23:04+00:00", "cites": ["https://certvde.com/en/advisories/VDE-2026-079/", "https://certvde.com/en/advisories/VDE-2026-141/"]}]
exploit_sources: []
---

# XSS in mbCONNECT24 and myREX24V2 admin backend lets attacker shut down server or restore a backup (fixed in 2.21.0)

Link for people: https://infrastack.ai/live/CVE-2026-60043 (this .md is for agents)

Cross-site scripting in the backend of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual (remote-maintenance portals). An unauthenticated attacker can run script in a logged-in backend user's browser, which can trigger server shutdown or restore of an uploaded backup. Vendor advisories rate it 9.3 and list firmware before 2.21.0 as affected; no exploitation or PoC is reported in the advisories.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mbCONNECT24 affected < 2.21.0 fixed 2.21.0
- vendor:mymbCONNECT24 affected < 2.21.0 fixed 2.21.0
- vendor:myREX24V2 affected < 2.21.0 fixed 2.21.0
- vendor:myREX24V2.virtual affected < 2.21.0 fixed 2.21.0

## How to check

Open the portal's firmware/version page (as admin) and confirm the firmware version. Anything below 2.21.0 on mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual is affected.

## Fix

Update to firmware 2.21.0 (mbCONNECT24/mymbCONNECT24 per VDE-2026-079; myREX24V2/myREX24V2.virtual per VDE-2026-141). Until then, admins should not browse untrusted links or sites while logged into the backend and should restrict backend access to trusted networks (general hardening, not from the advisory).

## Timeline

- 2026-11-10T09:21:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60043
- 2026-11-10T09:23:04+00:00 analyst https://certvde.com/en/advisories/VDE-2026-079/ — Identified via CERT@VDE VDE-2026-079 and VDE-2026-141 (read directly): affected firmware <2.21.0, fix 2.21.0. How-to-check step is derived from the affected range, not stated by vendor. No exploitation/PoC seen; X and Exa checks not run beyond one search.

## Documents

- [advisory] VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24 https://certvde.com/en/advisories/VDE-2026-079/
- [advisory] VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual https://certvde.com/en/advisories/VDE-2026-141/

## From the sources

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_