CVE-2026-60046highCWE-640

CVE-2026-60046: fallo de gravedad alta en Helmholz myREX24V2

DoS via password reset

Publicada el

Seguir esta CVE+ Monitorear mbCONNECT24+ Monitorear mymbCONNECT24

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

18Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
Helmholz · myREX24V2Helmholz · myREX24V2.virtualMB connect line · mbCONNECT24MB connect line · mymbCONNECT24
CVEs relacionadas — Helmholz myREX24V2

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-34580HIGHRemote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0EPSS 1.0%CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 1.0%CVE-2021-34575HIGHInformation Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0EPSS 1.0%CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2020-12528MEDIUMCVE-2020-12528EPSS 0.9%