An unauthenticated remote attacker can exploit a SQL Injection flaw in the userinfo endpoint caused by inadequate neutralization of special elements in a SQL SELECT statement. The flaw is a classic CWE-89 injection, allowing the attacker to retrieve sensitive information from the database, leading to total loss of confidentiality.

The vulnerability affects Helmholz myREX24V2 and myREX24V2.virtual, as well as MB Connect Line mbCONNECT24 and mymbCONNECT24, all running firmware or software version 2.20.0.

With a CVSS score of 8.7, the vulnerability is high severity, but no EPSS score is available, suggesting limited publicly known exploitation data. It is not listed in CISA KEV, yet it can be exploited over the network by sending crafted requests to the unauthenticated userinfo endpoint without requiring any credentials. The attack path is straightforward: any attacker can trigger the injection remotely by targeting the endpoint, making this a significant threat for exposed devices.