Skip to content
OpenAdvisories
Critical VDE-2026-025 2 CVEs

Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual

Published Mar 23, 2026 · Updated Mar 23, 2026

Vendor: Helmholz Product: myREX24V2.virtual

Summary

Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.

Details

Impact
CVE-2026-32968 allows unauthenticated RCE resulting in full system compromise impacting confidentiality, integrity, and availability, while CVE-2026-32969 allows unauthenticated SQLi resulting in arbitrary read access to the complete database.

Remediation
Update the myREX24V2/myREX24V2.virtual instance to version 2.19.4.

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-32968

    Unauthenticated RCE in com_mb24sysapi

    Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE…

    MB connect line Helmholz mymbCONNECT24 myREX24V2.virtual
  • High 7.5
    CVE-2026-32969

    Pre-Auth Blind SQLi in userinfo Endpoint

    An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confide…

    MB connect line Helmholz mymbCONNECT24 myREX24V2

Revision history

  1. #1.0.0

    Initial revision.

References