An unauthenticated remote attacker can exploit a SQL injection vulnerability in the _mb24confi_getTagAlarm function of the dataapi.php files. The flaw arises from improper neutralization of special characters in a SELECT statement, allowing malicious input to be executed. The attacker can gain full visibility of the underlying database, leading to a total loss of confidentiality of data stored by the system.

Helmholz myREX24V2 and its virtual edition, as well as MB connect line mbCONNECT24 and mymbCONNECT24, running firmware version 2.20.0, are affected by this vulnerability.

The CVSS score of 8.7 indicates high severity, and the absence of an available EPSS score means current exploitation probability is unknown but the vulnerability can be triggered without authentication over the network. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication requirements and potential for direct remote exploitation suggest a significant risk to the confidentiality of affected installations. Attackers with network access to the dataapi.php endpoint can inject arbitrary SQL code via the function and extract sensitive data.