Unauthenticated SQL Injection in Geutebruck G-Cam E-Series Cameras

Successful exploitation can allow a remote unauthenticated attacker to manipulate backend database queries and potentially read, modify, or delete data accessible to the application. Given the reported CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the expected impact includes high confidentiality, integrity, and availability consequences, including unauthorized access to sensitive configuration or stored data, tampering with application state, and possible service disruption. Depending on database privileges and product architecture, exploitation may also create opportunities for deeper system compromise through SQL-injection-related post-exploitation paths.

Restrict network access to the camera management and API interfaces, especially /uapi-cgi/viewer/Param.cgi, to trusted administrative networks only. Do not expose affected devices directly to the public Internet. Place devices behind firewalls or VPNs, apply ACLs to limit reachable source IPs, and monitor HTTP requests for anomalous or SQL-injection-like input targeting the Group parameter. Where operationally feasible, disable unnecessary remote access paths and segment affected cameras from broader enterprise networks until patched firmware can be deployed.

Update affected camera firmware to a secure version when one is available. The vulnerable request handling should be corrected to avoid incorporating direct user input into SQL statements, using parameterized queries or prepared statements instead.