Vulnerabilities in myREX24/myREX24.virtual

An attacker with login access could enumerate valid user accounts and bypass authentication to gain unauthorized access to the myREX24 device, potentially allowing them to modify control logic, change process parameters, or disrupt normal operations of connected industrial equipment.

Water authorities and utilities operating Helmholz myREX24 or myREX24.virtual remote terminal units (RTUs) or industrial controllers should apply these fixes. Affected devices are typically used in SCADA systems, remote monitoring, and distributed control applications where PLCs or RTUs manage critical infrastructure like water treatment, distribution networks, or power generation.

An attacker with network access to the myREX24 device and valid login credentials could exploit user enumeration to identify valid accounts, then use a password bypass technique to gain unauthorized admin access without requiring a valid password. From there, they could modify device configuration or control parameters.