The vulnerability is an unauthenticated SQL injection flaw in the getWidgetTags function, arising from insufficient neutralization of special characters in a SQL SELECT command. The flaw allows a low‑privileged remote attacker to inject malicious SQL that can read or modify database contents, resulting in total loss of confidentiality. The weakness is identified as CWE‑89.

Affected products are Helmholz MyREX24 V2 (including the virtual variant) and MB Connect Line MBConnect24 / myMBConnect24, all running firmware/OS version 2.20.0. These devices expose the getWidgetTags endpoint that is reachable over the network without authentication.

The CVSS score of 7.1 reflects a high‑severity vulnerability that is exploitable by remote actors who can reach the getWidgetTags URL. Although the EPSS score is not available, the lack of authentication and the simplicity of the injection indicate a realistic exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but its confidentiality impact and the need for early remediation make it a significant risk in environments where these devices are exposed.