Loading story…
A critical unauthenticated SQL injection vulnerability, tracked as CVE-2025-12463, was discovered in Geutebruck G-Cam E-Series cameras. The flaw exists in the Group parameter of the /uapi-cgi/viewer/Param.cgi script and has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19. The vulnerability is remotely exploitable and has been assigned a CVSS score of 9.8, indicating its severity and potential for exploitation without authentication.
Security researchers from Black Lantern Security demonstrated that the vulnerability could be exploited by injecting a URL-encoded XML CDATA block containing malicious SQL queries, allowing attackers to bypass the XML parser and manipulate database queries. Testing revealed that multiple versions of the G-Cam E-Series cameras are likely affected, though the full scope remains unconfirmed due to limited vendor response. The issue was reported to Geutebruck in July 2025, with public disclosure following a 90-day response window in November 2025.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Black Lantern Security published technical details confirming the vulnerability on a Geutebruck EFD-2130 camera running firmware 1.12.0.19. The write-up identified the issue as remotely exploitable without authentication and recommended firmware updates and safer SQL query handling.
A critical unauthenticated SQL injection vulnerability, CVE-2025-12463, was publicly disclosed for Geutebruck G-Cam E-Series cameras. The flaw affects the `/uapi-cgi/viewer/Param.cgi` endpoint via the `Group` parameter and was assigned a CVSS 9.8 score.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceblog.blacklanternsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026
CISA published an ICS advisory for **CVE-2026-40624**, a critical flaw affecting multiple AVer PTC camera models, including the **PTC500S, PTC115, PTC500+, and PTC115+**. The vulnerability stems from improper input validation and can allow a remote, unauthenticated attacker to achieve arbitrary code execution via a specially crafted web request. The issue is rated **Critical**, with a **CVSS v3.1 score of 9.8** and a **CVSS v4.0 score of 9.3**, and all listed versions of the affected products were reported as vulnerable. CISA said it had no reports of public exploitation targeting the flaw at the time of publication, but urged organizations to reduce internet exposure of control system devices, isolate affected networks, and use secure remote access methods such as fully updated VPNs. Additional mitigation guidance calls for updating camera firmware to the latest available version and applying vendor-provided security patches as they become available.
Jul 12, 2026