An unauthenticated remote attacker can exploit an injection flaw in the getAccountData function because special characters in a SQL SELECT query are not properly neutralized. This allows the attacker to execute arbitrary SQL statements against the backend database, leading to a complete loss of confidentiality as sensitive data can be extracted without restriction. The vulnerability is a classic instance of CWE‑89, reflecting improper input validation in database queries.

The flaw affects Helmholz's myREX24V2 and its virtual variant, as well as MB connect line's mbCONNECT24 and mym bCONNECT24 platforms, specifically version 2.20.0 of these systems. Systems identified by CPE strings such as cpe:2.3:a:helmholz:myrex24v2.* and cpe:2.3:a:mb_connect_line:mbconnect24.* are vulnerable.

The vulnerability is exploitable remotely without authentication, making it highly attractive to attackers. Its CVSS score of 8.7 indicates high impact and advanced exploitation steps. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the nature of the flaw suggests it could be leveraged by automated database exploitation tools. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending specially crafted requests to the getAccountData endpoint, potentially from any host that can reach the target system.