The _mb24api_getUserAccount function contains an unauthenticated SQL Injection flaw where special characters are not properly neutralized in a SELECT query. A remote attacker can send crafted requests without needing credentials and retrieve arbitrary data from the database, leading to a total loss of confidentiality. This vulnerability is a classic example of CWE‑89, allowing attackers to read sensitive information.

Affected products include Helmholz myREX24V2 and its virtual counterpart, both at version 2.20.0, as well as MB connect line mbCONNECT24 and mymbCONNECT24, also at version 2.20.0. These versions expose the API endpoint that is vulnerable to unauthenticated SQL injection.

The CVSS score of 8.7 indicates high severity, and although no EPSS data is provided, the lack of authentication requirements and the public API make the attack vector likely over the network. The vulnerability is already catalogued outside of KEV, but its potential for widespread data exposure makes it a high‑risk target for attackers. Exploitation requires no special privileges and can be performed by sending a malicious payload to the exposed API endpoint, bypassing all access controls.