The vulnerability is an unauthenticated remote SQL injection in the getLiveValues API, where the tagid parameter is not properly neutralized. Exploitation allows a threat actor to inject arbitrary SQL into a SELECT statement, potentially revealing sensitive data and causing a total loss of confidentiality. The weakness is classified as CWE‑89.

Affected products are Helmholz myREX24V2 and its virtual version, as well as MB Connect Line mbCONNECT24 and mymbCONNECT24. All impacted releases are identified as version 2.20.0 according to the provided CPE strings.

With a CVSS score of 8.7 the issue is considered high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated remote, inferred from the description that a remote attacker can exploit the vulnerability without credentials. If exploited, the attacker could access protected data exposed by the vulnerable SELECT statements.