A high‑privileged remote attacker can exploit an unauthenticated SQL Injection in the accountstatus view’s userid parameter because the application fails to properly neutralize special characters used in a SQL UPDATE command. The flaw allows the attacker to read the entire database and modify values in a non‑critical table, resulting in a total loss of confidentiality and some loss of integrity, as documented with CWE‑89.

The vulnerability impacts Helmholz’s myREX24V2 and myREX24V2.virtual products and MB Connect Line’s mbCONNECT24 and mymbCONNECT24 lines, all running the 2.20.0 release family.

With a CVSS score of 7 the flaw is considered high severity. While no EPSS score is available and the issue is not listed in the CISA KEV catalog, the requirement for a high‑privileged authenticated session and the ease of crafting a malicious userid imply a realistic exploitation path, especially on exposed web interfaces.