An unauthenticated remote attacker can exploit an SQL Injection vulnerability in the mb24alarm.php file's _mb24confi_getTagAlarm function, because special elements are not neutralized in a SELECT statement. The flaw allows the attacker to manipulate database queries, which can lead to a full loss of database confidentiality as the attacker can read, modify, or delete data. This exploitation does not require any authentication and is triggered by specially crafted requests.

The vulnerability affects Helmholz myREX24V2 running any of its virtual or non-virtual editions and the OEM MB Connect Line products mbCONNECT24 and mymbCONNECT24. All firmware releases based on 2.20.0 of Helmholz, and 2.20.0 of MB Connect Line, as identified by the CPEs listed, are impacted unless updated to a version that addresses the injection flaw.

The CVSS score of 8.7 indicates high severity, while the EPSS score is not available, suggesting no publicly reported exploitation yet. The flaw is listed as not in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the mb24alarm.php endpoint, which can be made from any location that can reach the device. Adversaries exploiting this could read sensitive configuration and alarm data, potentially affecting operational security.