An unauthenticated SQL Injection exists in the getComponentScalings function due to insufficient neutralization of special characters in a SQL SELECT statement. This flaw falls under CWE‑89 and allows an attacker with low privileged remote access to retrieve sensitive data, resulting in a total loss of confidentiality.

The vulnerability affects Helmholz myREX24V2 and myREX24V2.virtual devices, as well as MB connect line mbCONNECT24 and mymbCONNECT24 units running firmware version 2.20.0.

The CVSS score of 7.1 indicates a high severity. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the attack can be launched by a low privileged remote user who can send crafted requests to the affected function. The lack of authentication requirements makes the exploitation path straightforward, raising the likelihood of impact in environments where the affected devices are exposed to untrusted networks.