This vulnerability (CVE-2025-0603) affects Callvision Emergency Code versions prior to 3.0 and involves improper neutralization of special elements in SQL commands, categorized under CWE-89 (SQL Injection). It allows remote attackers to execute arbitrary SQL commands without authentication, potentially compromising the database's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on all security properties. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could lead to full compromise of the backend database, including unauthorized data disclosure, modification, or deletion, and potential disruption of service. The vulnerability affects all installations of Callvision Emergency Code before version 3.0. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing application-layer input validation and web application firewalls to detect and block SQL injection attempts. Monitor vendor communications closely for updates on patches or official mitigations.