An unauthenticated remote attacker can exploit a SQL Injection flaw in the getLiveValues function’s sn parameter due to inadequate neutralization of special characters in a SQL SELECT statement. The vulnerability is identified as CWE‑89 and can lead to a total loss of confidentiality of sensitive data. It requires no authentication and can be triggered over the network. The data exposed can include proprietary system settings and user information. The attack allows the attacker to read arbitrary data from the underlying database.

Helmholz products myREX24V2 and myREX24V2.virtual running OS version 2.20.0, as well as MB connect line products mbCONNECT24 and mymbCONNECT24 also at version 2.20.0. These devices expose an endpoint that processes the getLiveValues request.

The CVSS score of 8.7 indicates a high severity issue. The exploit is possible over the network without any prior authentication, implying a high likelihood of attack if the endpoint is reachable. Although the EPSS score is not available, the lack of authentication requirement and the high CVSS suggest that the vulnerability could be actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, but the remote nature and high impact warrant immediate mitigation.