The vulnerability is a classic SQL injection flaw (CWE‑89) that allows an attacker to insert arbitrary SQL statements into a query sent by the FAYDAM Datalogger. If exploited, the attacker can read, modify, or delete data in the underlying database, potentially exposing sensitive device configurations, logs, or user information. The data compromise could be local or remote depending on how the datalogger’s interface is accessed. The description explicitly states that the flaw is an "improper neutralization of special elements used in an SQL command." No other functionality such as remote code execution is mentioned, so the impact is limited to database manipulation and data exfiltration.

Faydam Innovation Inc. FAYDAM Datalogger versions from 2.7.1 up to, but not including, 2.8.0 are affected. No other products or versions are listed.

The CVSS score of 9.8 marks this as critical, indicating a high level of risk if present. The EPSS score is not available, so the exploitation probability cannot be precisely quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw through any input that is passed directly to an SQL command in the datalogger, likely via a web or API endpoint that accepts user-supplied data. Successful exploitation does not require pre‑existing user credentials because the flaw is in the query handling layer, but it does require access to the datalogger’s interface or network segment.