An unauthenticated remote attacker can use a cross-site scripting (XSS) flaw against a logged-in backend user to trigger critical system actions in MB connect line and Helmholz remote-access platforms, such as a server shutdown or a backup restore.
What Is It
CVE-2026-60043 is a cross-site scripting vulnerability (CWE-79). CERT@VDE reported it, and it was published to NVD on 2026-11-10. NVD currently lists its status as "Received."
The attacker does not need to log in. Instead, they target a backend user who is already logged in. Through that user's session, the attacker can carry out "multiple critical system actions." The record names two of them: shutting down the server and restoring a backup the attacker has uploaded.
Why It Matters
CERT@VDE scores this flaw 9.3 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H). The attack works over the network, has low complexity and needs no privileges. It does need a user to interact, and the scope is changed, so the impact reaches beyond the vulnerable component. The impact is high for integrity and availability. There is no confidentiality impact.
The CVSS 4.0 score from the same source is lower, 6.4 MEDIUM. That rating marks user interaction as passive. It places the high integrity and availability impact on downstream ("subsequent") systems, not on the vulnerable component itself.
Restoring a backup the attacker uploaded could let them overwrite the platform's configuration. A shutdown takes the service offline. Both risks are serious for remote-access infrastructure.
KEV status: The supplied CISA KEV data has no entry for this CVE. Active exploitation is not confirmed.
What's Vulnerable
These products are affected in versions 2.0.0 up to, but not including, 2.21.0:
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- Helmholz myREX24V2
- Helmholz myREX24V2.virtual
All other versions are listed as unaffected by default.
Patch Status
The affected range ends just before version 2.21.0. Versions from 2.21.0 onward are not listed as affected. Operators running 2.0.0 through 2.20.x should check the CERT@VDE advisories below for the vendor's fixed release and remediation guidance. CISA has not set a required action, because the KEV data has no listing for this CVE.