VDE-2026-043

csafDEhelmholz_psirt

Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual

view advisory published 2026-04-13

Multiple vulnerabilities have been discovered in Helmholz myREX24V2/myREX24V2.virtual that could allow RCE, SQLi or information leakage.

01

describes (5)

Related CVEs.

IDseverity exploitable
CVE-2026-33617US——
An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint expo…
CVE-2026-33616US——
An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a…
CVE-2026-33615US——
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UP…
CVE-2026-33614US——
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SE…
CVE-2026-33613UShigh8.8—
Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full…
02

references

External citations — patches, advisories, analysis.

03

remediations (5)

  • Fixed

    Update the myREX24V2/myREX24V2.virtual instance to version 2.19.5

  • Fixed

    Update the myREX24V2/myREX24V2.virtual instance to version 2.19.5.

  • Fixed

    Update the myREX24V2/myREX24V2.virtual instance to version 2.19.5.

  • Fixed

    Update the myREX24V2/myREX24V2.virtual instance to version 2.19.5.

  • Fixed

    Update the myREX24V2/myREX24V2.virtual instance to version 2.19.5.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan