An attacker with high privileges can exploit an unauthenticated SQL injection in the _RemoveRequest function because special characters are not properly neutralized in a SQL DELETE command. The flaw allows the attacker to read the entire database and delete entries in a non‑critical table, resulting in loss of confidentiality and some loss of integrity.

Helmholz myREX24V2, myREX24V2.virtual, MB connect line mbCONNECT24, mymbCONNECT24, all in version 2.20.0 where the vulnerability exists.

The CVSS score of 7 indicates a medium‑high severity vulnerability. The exploit probability is not available, and the vulnerability is not listed in the CISA KEV catalog. A high‑privileged remote attacker can leverage the flaw, which requires local or network access to the target device and the ability to submit requests to the _RemoveRequest endpoint. If successfully exploited, the attacker can exfiltrate data and modify or delete database records.