The vulnerability is a classic SQL injection flaw (CWE‑89) that allows an attacker to insert arbitrary SQL statements into the command used by the FAYDAM Datalogger. Exploitation could enable the attacker to read, modify, or delete data stored in the underlying database, potentially exposing device configurations, logs, or user information and compromising data confidentiality and integrity.

FAYDAM Datalogger from the 2.7.1 release up to, but not including, 2.8.0 are affected. No other versions or products are listed.

The CVSS score of 9.8 marks the flaw as critical, indicating a high level of risk if present. The EPSS score is <1%, indicating a very low but possible exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any interface that passes user‑supplied data to an SQL command without proper neutralization; this is inferred because the description only states that the datalogger allows SQL injection. The vulnerability does not specify required credentials, so it is inferred that the attacker may need access to the datalogger’s interface or network segment but no explicit credential prerequisites are documented.