The vulnerability is an unauthenticated SQL injection in the ssoabstractservice. Because the service does not properly neutralize special characters in a SQL SELECT command, a remote attacker can inject arbitrary SQL code. The lack of authentication requirements allows anyone to send malicious requests, resulting in a total loss of confidentiality as an attacker can read any data stored in the database.

The issue affects Helmholz myREX24V2 and its virtual variant, as well as MB connect line mbCONNECT24 and mymbCONNECT24. The impacted versions are inferred from the CPE entries, which reference version 2.20.0; the original description does not specify the fixed version.

The flaw carries a CVSS score of 8.7, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward: a remote attacker can send a crafted request to the ssoabstractservice endpoint over the network without authentication and embed malicious SQL. Successful injection would grant the attacker full read access to the database. The likely attack vector is internet-facing connections to the service. The absence of authentication and the high CVSS score underscore the critical nature of this vulnerability.