Vendor
Helmholz
77 known vulnerabilities in products by Helmholz, 0 of them actively exploited (CISA KEV).
Key figures
77
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-45274 | MB connect line/Helmholz: Remote code execution via confnet service | 9.8 | |
| High | CVE-2026-14448 | Authenticated RCE in system_certificates view | 7.2 | |
| Critical | CVE-2026-32968 | Unauthenticated RCE in com_mb24sysapi | 9.8 | |
| High | CVE-2020-35558 | SSRF in products of MB connect line and Helmholz | 7.5 | |
| Critical | CVE-2024-45275 | MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords | 9.8 | |
| High | CVE-2024-5672 | Red Lion Europe: mbNET.mini vulnerable to OS command injection | 7.2 | |
| High | CVE-2023-0985 | Helmholz and MB Connect Line: Account takeover via password reset in multiple products | 8.8 | |
| High | CVE-2025-41688 | High Privilege RCE via LUA Sandbox Escape | 7.2 | |
| High | CVE-2026-40850 | Unauthenticated SQLi in getAccountData function | 7.5 | |
| High | CVE-2025-41675 | MB connect line mbNET.mini: OS Command Injection | 7.2 | |
| High | CVE-2025-41674 | Remote Command Injection in diagnostic Action Due to Improper Input Neutralization | 7.2 | |
| High | CVE-2025-41673 | Remote Command Injection in send_sms Action Due to Improper Input Neutralization | 7.2 | |
| High | CVE-2026-40817 | Unauthenticated SQLi in getAlarmProfiles function | 7.5 | |
| High | CVE-2026-40819 | Unauthenticated SQLi in sync_data24 task | 7.5 | |
| High | CVE-2026-40815 | Unauthenticated SQLi in _mb24api_getUserAccount function | 7.5 | |
| High | CVE-2026-40814 | Unauthenticated SQLi in _mb24confi_getTagAlarm function | 7.5 | |
| High | CVE-2026-40812 | Unauthenticated SQLi in getLiveValues function | 7.5 | |
| High | CVE-2026-40811 | Unauthenticated SQLi in ssoabstractservice | 7.5 | |
| High | CVE-2026-40818 | Unauthenticated SQLi in _mb24confi_getDevice function function | 7.5 | |
| High | CVE-2026-40816 | Unauthenticated SQLi in _mb24confi_getTagAlarm function | 7.5 | |
| High | CVE-2026-40813 | Unauthenticated SQLi in getLiveValues | 7.5 | |
| High | CVE-2026-40810 | Unauthenticated SQLi in userinfo Endpoint | 7.5 | |
| Medium | CVE-2020-12527 | Improper Access Validation in products of MB connect line and Helmholz | 6.5 | |
| Medium | CVE-2020-35570 | Foreced Browsing vulnerability in products of MB connect line and Helmholz | 5.3 | |
| High | CVE-2026-32969 | Pre-Auth Blind SQLi in userinfo Endpoint | 7.5 |
Products
| Helmholz myREX24V2 | 43 | 0 |
| Helmholz myREX24V2.virtual | 43 | 0 |
| Helmholz myREX24.virtual | 17 | 0 |
| Helmholz myREX24 | 15 | 0 |
| Rex 100 | 9 | 0 |
| Helmholz REX100 | 7 | 0 |
| Rex 100 Firmware | 5 | 0 |
| Rex200/250 | 3 | 0 |
| Rex 200 Firmware | 3 | 0 |
| Rex 250 Firmware | 3 | 0 |