CVE-2025-12463 | An unauthenticated SQL Injection was discovered within the G… | CVSS 9.8 CRITICAL

Description

An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19.

Metadata

CVE ID: CVE-2025-12463
State: PUBLISHED
Assigner: BLSOPS
Reserved: 2025-10-29 11:28 UTC
Published: 2025-11-03 16:45 UTC
Last updated: 2025-11-03 20:51 UTC
Primary CWE: CWE-89
CWE-89 Improper Neutralization of Special Elements used in a…
Vendor / Product: Guetebruck / G-Cam
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Guetebruck	G-Cam	—	1.12.0.19

Weakness (CWE)

CWE	Source	Description
CWE-89	cna	CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://blog.blacklanternsecurity.com/p/cve-2025-12463-98-unauthenticated