Skip to content
OpenAdvisories
High VDE-2026-059 2 CVEs

Helmholz: Multiple vulnerabilities in REX100/REX200/REX250

Published May 27, 2026 · Updated May 27, 2026

Vendor: Helmholz Product: REX100 Product: REX200/250

Summary

Two command injection vulnerabilities have been discovered in Helmholz REX100/REX200/REX250.

Details

Impact
The vulnerabilities allow for command injection in REX100/REX200/REX250 with varying prerequisites resulting in full system compromise.

Remediation
Update:

- REX200/REX250: 8.4.5
- REX100: 3.0.3

Vulnerabilities 2

  • High 8.4
    CVE-2026-40851

    Command injection via USB

    A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

    MB connect line Helmholz mbNET.mini REX100
  • High 7.2
    CVE-2026-40852

    Command injection via malicious configuration

    A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can res…

    MB connect line Helmholz mbNET.mini REX100

Revision history

  1. #1.0.0

    Initial revision.

References