The vulnerability is a classic SQL Injection (CWE‑89) within the getAccountByID function, where improper neutralization of special characters allows an attacker to inject arbitrary SQL into a SELECT statement. An attacker with sufficient privileges can retrieve arbitrary data from the database, leading to a complete loss of confidentiality. The impact is limited to unauthorized data exposure rather than code execution or denial of service.

Helmholz myREX24V2 and myREX24V2.virtual, including the 2.20.0 firmware releases, as well as MB connect line mbCONNECT24 and mymbCONNECT24 products in the same 2.20.0 family. All listed versions are affected by the SQL injection flaw.

The CVSS score of 6.9 indicates a medium severity impact. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV database, suggesting that no widespread exploitation has been confirmed yet. The attack vector is inferred to be remote, requiring network access to the service that hosts the getAccountByID function, and the description indicates that an attacker with high privileges can exploit it. Defenses must therefore focus on sanitizing input, restricting privileged access, and monitoring for anomalous SQL activity.