Helmholz: Remote user enumeration in myREX24/myREX24-virtual

An attacker can enumerate valid user accounts on myREX24 controllers without authentication, potentially enabling targeted account compromise or social engineering attacks against operators.

Industrial automation operators using Helmholz myREX24 controllers or myREX24-virtual systems in any plant or facility. This affects anyone relying on these controllers for process control, monitoring, or automation tasks.

An attacker on the network sends requests to the myREX24 controller to probe for valid usernames. The system reveals which accounts exist through response differences, allowing the attacker to build a list of legitimate users for further attacks.