External risk intelligence

Geutebruck G-Cam SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12463

The vulnerability exists in a network-accessible CGI script on Geutebruck surveillance cameras. Security cameras are frequently deployed as internet-facing devices or connected to public-facing edge gateways for remote monitoring and management, making this specific interface commonly reachable over the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Geutebruck cameras, specifically within a network-accessible script used for viewer parameters. This flaw allows unauthenticated attackers to potentially compromise the affected devices by injecting malicious SQL commands, which could lead to significant data breaches or service disruptions. The main concern at this time is to confirm if these types of cameras are in use within our environment.

Unauthenticated SQL injection in network cameras.
Critical flaw could lead to data breaches.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the camera's network interface. The vulnerable script, accessible via the network, processes a `Group` parameter without proper validation. This allows an attacker to inject malicious SQL code, potentially leading to unauthorized access, data modification, or system disruption.

No authentication required.
Triggered by the `Group` parameter.
Risk of unauthorized access and control.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated SQL injection vulnerability in Geutebruck G-Cam E-Series Cameras could allow an attacker to manipulate database queries when interacting with the `Param.cgi` script. This could potentially lead to unauthorized access or modification of camera system data.

Camera system configuration and data.
Network-based interaction with the `Param.cgi` script.
Compromised camera integrity or data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership This critical SQL injection vulnerability in Geutebruck G-Cam E-Series cameras, specifically impacting the `Param.cgi` script, likely falls under the purview of teams managing physical security infrastructure and their associated network. The first practical step is to inventory all deployed Geutebruck E-Series cameras, determine their network exposure, confirm business criticality, and identify the accountable system owner before planning remediation.

Physical security and network teams own this.
Verify camera network exposure and criticality.
Coordinate vendor response and plan updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are Geutebruck G-Cam E-Series cameras?

These are professional surveillance devices used for monitoring physical environments. The E-Series models, such as the EFD-2130, include built-in web management interfaces that allow operators to configure settings and view footage remotely over a network connection.

What is the SQL injection vulnerability in CVE-2025-12463?

This vulnerability falls under the CWE-89 weakness class, which happens when software fails to properly filter user input before including it in a database query. In this case, the `Param.cgi` script accepts a `Group` parameter that an attacker can manipulate to execute unauthorized database commands, potentially letting them read, change, or destroy the camera's system data.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request containing malicious code within the `Group` parameter to the camera's web script. It is important to note that the vulnerability does not require any login credentials to succeed; the camera will process the malicious input simply because it is sent to the target interface.

Do I need to worry if my cameras are not on the public internet?

While internal-only devices face a lower immediate risk, Halo Surface Signal notes that these cameras are frequently deployed as internet-facing or connected to public-facing edge gateways. You should assess if your specific deployment allows network traffic to reach the device's web interface, as any pathway—internal or external—that reaches this script can potentially be used to exploit the device.

What are the first steps to secure my environment?

Start by conducting an inventory to locate all Geutebruck E-Series cameras in your network. Once identified, consult your physical security or network management teams to determine if these devices are reachable over the network and verify their current firmware version. Prioritize isolating these cameras from untrusted networks while you coordinate with the vendor to obtain and apply the necessary security updates.

References

blog.blacklanternsecurity.com/p/cve-2025-12463-98-unauthenticated

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.