{"id":"CVE-2026-60044","kind":"vulnerability","aliases":["CVE-2026-60044"],"related":[],"title":"mbCONNECT24, mymbCONNECT24 and myREX24V2 backups use a weak static password, letting an unauthenticated attacker read them","description":"The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality.","summary":"Backups created by MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual use a weak static password. An unauthenticated remote attacker can access their content (CVSS 7.5, confidentiality only). Fixed in 2.21.0. Reported by SySS GmbH; CERT@VDE coordinated.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"mymbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["backups","ics","mbconnect24","mymbconnect24","myrex24v2","other","remote-maintenance","self-hosted"],"not_affected_if":[],"how_to_check":"Check the installed firmware/software version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance; anything below 2.21.0 is affected. Treat existing backup files as readable by anyone who obtains them.","fix":"Update the instance to version 2.21.0 (vendor remediation in VDE-2026-079 and VDE-2026-141).","status":"open","published_at":"2026-11-10T09:17:24+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","triaged_at":"2026-11-10T09:21:13+00:00","updated_at":"2026-11-10T09:23:29+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T09:21:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Application backups protected by weak static password, exposing all content remotely","impact":"high","summary":"The application encrypts or protects its backups with a weak, fixed password. An unauthenticated remote attacker can open those backups and read their contents.","audience":"businesses","category":"other","nicknames":[],"who_cares":["backups"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads all backed-up application data without credentials","analyst_note":"Identify the affected application and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60044; sources list no products.","how_to_check":"- unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":4493,"output_tokens":348,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected application and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60044; sources list no products.","search":"'-2026':17A,20A '-60044':18A,21A '2.21.0':67B '7.5':62B 'access':58B,92C 'allow':86C 'applic':80C 'attack':14A,56B,90C 'backup':5A,26B,38B,76C 'cert':72B 'confidenti':63B,103C 'connect':42B 'content':60B,94C 'coordin':74B 'creat':39B,77C 'cve':16A,19A 'cvss':61B 'fix':65B 'gmbh':71B 'helmholz':46B 'host':37B 'ic':27B 'let':11A 'line':43B 'loss':101C 'mainten':34B 'mb':41B 'mbconnect24':1A,22A,28B 'mbconnect24/mymbconnect24':44B 'mymbconnect24':2A,23A,29B 'myrex24v2':4A,24A,30B 'myrex24v2.virtual':25A 'myrex24v2/myrex24v2.virtual':47B 'password':10A,52B,85C 'read':15A 'remot':33B,55B,89C 'remote-mainten':32B 'report':68B 'result':97C 'self':36B 'self-host':35B 'static':9A,51B,84C 'syss':70B 'total':100C 'unauthent':13A,54B,88C 'use':6A,48B,81C 'vde':73B 'weak':8A,50B,83C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-hosted or hosted-by-you mbCONNECT24, mymbCONNECT24 (MB connect line) or myREX24V2 / myREX24V2.virtual (Helmholz) remote-maintenance portal on a version below 2.21.0. Backups these systems create are protected only by a weak static password, so anyone who can get at a backup can read it. Teams not running these products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:23:29Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2430},"products":{"at":"2026-11-10T09:23:29Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2430},"who_affected":{"at":"2026-11-10T09:23:29Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2430}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mbconnect24","mymbconnect24","myrex24v2","myrex24v2virtual"],"ptokens":["mbconnect24","mymbconnect24","myrex24v2","virtual"],"labels":["backups","high","ics","mbconnect24","mymbconnect24","myrex24v2","other","remotemaintenance","selfhosted"],"campaign_type":null,"search_a":"'-2026':17A,20A '-60044':18A,21A 'attack':14A 'backup':5A 'cve':16A,19A 'let':11A 'mbconnect24':1A,22A 'mymbconnect24':2A,23A 'myrex24v2':4A,24A 'myrex24v2.virtual':25A 'password':10A 'read':15A 'static':9A 'unauthent':13A 'use':6A 'weak':8A","search_b":"'2.21.0':67B '7.5':62B 'access':58B 'attack':56B 'backup':26B,38B 'cert':72B 'confidenti':63B 'connect':42B 'content':60B 'coordin':74B 'creat':39B 'cvss':61B 'fix':65B 'gmbh':71B 'helmholz':46B 'host':37B 'ic':27B 'line':43B 'mainten':34B 'mb':41B 'mbconnect24':28B 'mbconnect24/mymbconnect24':44B 'mymbconnect24':29B 'myrex24v2':30B 'myrex24v2/myrex24v2.virtual':47B 'password':52B 'remot':33B,55B 'remote-mainten':32B 'report':68B 'self':36B 'self-host':35B 'static':51B 'syss':70B 'unauthent':54B 'use':48B 'vde':73B 'weak':50B","search_c":"'access':92C 'allow':86C 'applic':80C 'attack':90C 'backup':76C 'confidenti':103C 'content':94C 'creat':77C 'loss':101C 'password':85C 'remot':89C 'result':97C 'static':84C 'total':100C 'unauthent':88C 'use':81C 'weak':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60044","severity":null,"published_at":"2026-11-10T09:17:24+00:00","modified_at":"2026-11-10T09:17:24+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","fetched_at":"2026-11-10T09:21:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60044:2430","url":"https://certvde.com/en/advisories/VDE-2026-079/","severity":null,"published_at":"2026-11-10T09:23:29+00:00","modified_at":"2026-11-10T09:23:29+00:00","first_seen_at":"2026-11-10T09:23:29+00:00","fetched_at":"2026-11-10T09:23:29+00:00","note":"Identified from CERT@VDE VDE-2026-079 (MB connect line) and VDE-2026-141 (Helmholz); both published 2026-11-10, fixed in 2.21.0. Advisory does not say how an attacker obtains the backup, nor how to read the version; no exploitation or PoC seen. how_to_check not marked verified.","cites":["https://certvde.com/en/advisories/VDE-2026-079/","https://certvde.com/en/advisories/VDE-2026-141/"]}],"documents":[{"id":114178,"url":"https://certvde.com/en/advisories/VDE-2026-079/","title":"VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114179,"url":"https://certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}