{"id":"CVE-2026-60046","kind":"vulnerability","aliases":["CVE-2026-60046"],"related":[],"title":"mbCONNECT24 and myREX24V2 remote access portals: anyone who knows a username and email can reset that user's password, no rate limiting","description":"An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.","summary":"CERT@VDE advisories VDE-2026-079 and VDE-2026-141 (reported by SySS) list this flaw in MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual, all firmware below 2.21.0. An unauthenticated remote attacker who knows a username and email can reset that user's password repeatedly, locking the owner out. CVSS 3.1 7.5 per the advisory.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"mymbCONNECT24","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"},{"name":"myREX24V2.virtual","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["helmholz","industrial","mb-connect-line","mbconnect24","mymbconnect24","myrex24v2","other","remote-access"],"not_affected_if":[],"how_to_check":"Check the firmware/version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance; anything below 2.21.0 is affected.","fix":"Update to version 2.21.0 (per VDE-2026-079 and VDE-2026-141).","status":"open","published_at":"2026-11-10T09:17:24+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","triaged_at":"2026-11-10T09:21:13+00:00","updated_at":"2026-11-10T09:22:55+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T09:21:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unknown product: password resets possible for any user without rate limiting","impact":"medium","summary":"An unauthenticated remote attacker can trigger password resets for any account if they know the username and email, because there is no rate limiting. The victim loses access to their account once the password is reset.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker resets any known user's password, locking the account owner out","analyst_note":"Identify the affected product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60046, then confirm fixed versions and whether the reset endpoint is exposed by default.","how_to_check":"unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources name no product, so it is not clear which application or service exposes the password reset endpoint without rate limiting.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":4498,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60046, then confirm fixed versions and whether the reset endpoint is exposed by default.","search":"'-079':51B '-141':55B '-2026':24A,27A,50B,54B '-60046':25A,28A '2.21.0':73B '3.1':96B '7.5':97B 'access':5A,45B 'advisori':48B,100B 'anyon':7A 'attack':77B,104C 'availabilit':128C 'cert':46B 'connect':37B,64B 'cve':23A,26A 'cvss':95B 'email':13A,83B,116C 'firmwar':71B 'flaw':61B 'helmholz':33B,68B 'industri':34B 'know':9A,79B 'known':113C 'limit':22A,119C 'line':38B,65B 'list':59B 'lock':91B 'loss':126C 'mb':36B,63B 'mb-connect-lin':35B 'mbconnect24':1A,29A,39B 'mbconnect24/mymbconnect24':66B 'mymbconnect24':30A,40B 'myrex24v2':3A,31A,41B 'myrex24v2.virtual':32A 'myrex24v2/myrex24v2.virtual':69B 'owner':93B 'password':19A,89B,107C,131C 'per':98B 'perform':106C 'portal':6A 'rate':21A,118C 'remot':4A,44B,76B,103C 'remote-access':43B 'repeat':90B 'report':56B 'reset':15A,85B,108C,134C 'result':122C 'sinc':129C 'syss':58B 'total':125C 'unauthent':75B,102C 'user':17A,87B,111C 'usernam':11A,81B,114C 'vde':47B,49B,53B 'without':117C","nicknames":[],"mitigations":[],"who_affected":"Teams running MB connect line mbCONNECT24/mymbCONNECT24 or Helmholz myREX24V2/myREX24V2.virtual remote-access portals on firmware below 2.21.0, especially ones reachable from the internet. An attacker needs a valid username and email. Anyone on 2.21.0 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T09:22:55Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2429},"products":{"at":"2026-11-10T09:22:55Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2429},"how_to_check":{"at":"2026-11-10T09:22:55Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2429},"who_affected":{"at":"2026-11-10T09:22:55Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-141/","run_id":2429}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mbconnect24","mymbconnect24","myrex24v2","myrex24v2virtual"],"ptokens":["mbconnect24","mymbconnect24","myrex24v2","virtual"],"labels":["helmholz","high","industrial","mbconnect24","mbconnectline","mymbconnect24","myrex24v2","other","remoteaccess"],"campaign_type":null,"search_a":"'-2026':24A,27A '-60046':25A,28A 'access':5A 'anyon':7A 'cve':23A,26A 'email':13A 'know':9A 'limit':22A 'mbconnect24':1A,29A 'mymbconnect24':30A 'myrex24v2':3A,31A 'myrex24v2.virtual':32A 'password':19A 'portal':6A 'rate':21A 'remot':4A 'reset':15A 'user':17A 'usernam':11A","search_b":"'-079':51B '-141':55B '-2026':50B,54B '2.21.0':73B '3.1':96B '7.5':97B 'access':45B 'advisori':48B,100B 'attack':77B 'cert':46B 'connect':37B,64B 'cvss':95B 'email':83B 'firmwar':71B 'flaw':61B 'helmholz':33B,68B 'industri':34B 'know':79B 'line':38B,65B 'list':59B 'lock':91B 'mb':36B,63B 'mb-connect-lin':35B 'mbconnect24':39B 'mbconnect24/mymbconnect24':66B 'mymbconnect24':40B 'myrex24v2':41B 'myrex24v2/myrex24v2.virtual':69B 'owner':93B 'password':89B 'per':98B 'remot':44B,76B 'remote-access':43B 'repeat':90B 'report':56B 'reset':85B 'syss':58B 'unauthent':75B 'user':87B 'usernam':81B 'vde':47B,49B,53B","search_c":"'attack':104C 'availabilit':128C 'email':116C 'known':113C 'limit':119C 'loss':126C 'password':107C,131C 'perform':106C 'rate':118C 'remot':103C 'reset':108C,134C 'result':122C 'sinc':129C 'total':125C 'unauthent':102C 'user':111C 'usernam':114C 'without':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60046","severity":null,"published_at":"2026-11-10T09:17:24+00:00","modified_at":"2026-11-10T09:17:24+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","fetched_at":"2026-11-10T09:21:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60046:2429","url":"https://certvde.com/en/advisories/VDE-2026-079/","severity":null,"published_at":"2026-11-10T09:22:55+00:00","modified_at":"2026-11-10T09:22:55+00:00","first_seen_at":"2026-11-10T09:22:55+00:00","fetched_at":"2026-11-10T09:22:55+00:00","note":"Product identified from CERT@VDE VDE-2026-079 / VDE-2026-141; fix 2.21.0. No exploitation or PoC seen (not searched social). NVD/CNA CVSS4 8.7, advisory CVSS3.1 7.5; severity unchanged.","cites":["https://certvde.com/en/advisories/VDE-2026-079/","https://certvde.com/en/advisories/VDE-2026-141/"]}],"documents":[{"id":114178,"url":"https://certvde.com/en/advisories/VDE-2026-079/","title":"VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114179,"url":"https://certvde.com/en/advisories/VDE-2026-141/","title":"VDE-2026-141 Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}