For awareness Medium Check exposure in your normal cycle
Multiple flaws in Helmholz myREX24V2 remote-access routers
CERT@VDE advisoriesHelmholz, myREX24V2, myREX24V2.virtual
What happened. CERT@VDE reports multiple vulnerabilities in Helmholz myREX24V2 and myREX24V2.virtual. They could allow remote code execution, denial of service or information leakage. The advisory is VDE-2026-141.
Who is affected. Sites using Helmholz myREX24V2 or myREX24V2.virtual for remote access are exposed, because vendors and engineers often reach plant systems this way. Versions are not given.
What to do. Check whether you run myREX24V2 or myREX24V2.virtual and follow the fix guidance in advisory VDE-2026-141.
When to act. For awareness: myREX24V2 users: no exploitation is stated, so check exposure and schedule the fix.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L5
- L3.5
Why: The myREX24V2 is a remote-access router at the plant edge, so it acts as a gateway between the internet and plant networks (L3.5, L5).
- Are you exposed?
Search the asset inventory and remote-access list for myREX24V2 and myREX24V2.virtual units, including virtual instances.
- If you cannot fix it yet
- Limit who can connect through the router and require multi-factor authentication where supported.
- Keep the router's management interface off the internet and off the plant network until patched.
- Review router logs for access attempts from unknown sources.
- Watch for
- Logons or configuration changes on the router from unfamiliar addresses.
- Unexpected reboots or service outages on the router, which could indicate denial-of-service attempts.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CERT@VDE advisories (opens certvde.com)
More on Helmholz myREX24V2 myREX24V2.virtual