A blind SQL injection flaw exists in the userinfo endpoint’s authentication logic. The vulnerability arises because special characters are not properly escaped in a SELECT statement, allowing an attacker to send crafted inputs that are executed by the database. Because the endpoint can be accessed without authentication, an attacker can reveal private data that should remain confidential.

Installed units of Helmholz myREX24V2 and myREX24V2.virtual, and MB connect line devices using mbCONNECT24 or mymbCONNECT24, are potentially affected. No particular version ranges are specified, so all currently deployed copies should be considered at risk.

The reported CVSS score of 7.5 indicates a high severity risk. While detailed likelihood metrics are not available, the flaw can be triggered remotely without credentials, making exploitation straightforward for an attacker. Successful exploitation would provide the attacker with access to sensitive information stored in the backend database. The vulnerability is not catalogued in the major known-exploited-vulnerabilities registry, but its high impact warrants prompt attention.