MBCONNECT24 · CVE-2026-60046 · Other
FIX → 2.21.0 ✓ verified
CERT@VDE advisories VDE-2026-079 and VDE-2026-141 (reported by SySS) list this flaw in MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual, all firmware below 2.21.0. An unauthenticated remote attacker who knows a username and email can reset that user's password repeatedly, locking the owner out. CVSS 3.1 7.5 per the advisory.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running MB connect line mbCONNECT24/mymbCONNECT24 or Helmholz myREX24V2/myREX24V2.virtual remote-access portals on firmware below 2.21.0, especially ones reachable from the internet. An attacker needs a valid username and email. Anyone on 2.21.0 or later can skip it.
Who cares helmholz, industrial, mb-connect-line, mbconnect24, mymbconnect24, myrex24v2, remote-access
Check the firmware/version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance; anything below 2.21.0 is affected.
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.21.0
Update to version 2.21.0 (per VDE-2026-079 and VDE-2026-141).