CVE-2025-48735 is a SQL Injection vulnerability identified in BOS IP cameras running firmware version 21.45.8.2.2_220219 and earlier. The flaw arises from improper neutralization of special elements in SQL commands within the request body processing logic. Specifically, the vulnerability allows remote attackers to craft malicious input in the request body that is not properly sanitized or parameterized before being incorporated into SQL queries executed by the device. This enables attackers to manipulate the backend database queries, potentially extracting sensitive information stored within the camera's database. The vulnerability does not require user interaction but does require some level of privilege (PR:L) to exploit, indicating that the attacker must have limited privileges or authenticated access to the device's interface or API. The CVSS v3.1 base score is 4.3 (medium severity), reflecting that the attack vector is network-based with low attack complexity and no user interaction, but limited to confidentiality impact without affecting integrity or availability. No known exploits are currently reported in the wild, and no patches have been linked yet, suggesting that mitigation may rely on firmware updates once released. The vulnerability falls under CWE-89, which is a common and well-understood class of injection flaws that can lead to unauthorized data disclosure if exploited successfully.

For European organizations deploying BOS IP cameras, this vulnerability poses a risk of unauthorized disclosure of sensitive information stored on the camera's internal database. Such information could include configuration details, user credentials, or recorded metadata, which could be leveraged for further attacks or espionage. Given the network-exposed nature of IP cameras, attackers could remotely exploit this flaw to gain insights into the device environment without needing physical access. This could compromise the confidentiality of surveillance data and potentially expose organizational security postures. While the vulnerability does not directly impact device integrity or availability, the leakage of sensitive data could undermine trust in security infrastructure, lead to compliance violations under GDPR if personal data is involved, and facilitate lateral movement within networks. The medium severity score suggests a moderate risk, but the actual impact depends on the deployment scale and sensitivity of the data stored on these devices. Organizations in critical infrastructure sectors, government, or enterprises with extensive BOS IP camera deployments should be particularly vigilant.

1. Immediate mitigation involves restricting access to BOS IP cameras to trusted networks only, using network segmentation and firewall rules to limit exposure to untrusted or public networks. 2. Enforce strong authentication and access controls on the camera management interfaces to prevent unauthorized or low-privilege access that could be leveraged to exploit the vulnerability. 3. Monitor network traffic and logs for unusual or suspicious request patterns targeting the cameras, especially those containing anomalous payloads indicative of SQL injection attempts. 4. Coordinate with BOS for timely firmware updates addressing this vulnerability; prioritize patching affected devices as soon as a fix is released. 5. Where possible, disable or restrict unnecessary services or APIs on the cameras that process request bodies to reduce the attack surface. 6. Conduct regular security assessments and penetration testing on IP camera deployments to identify and remediate similar injection flaws proactively. 7. Implement Web Application Firewall (WAF) or Intrusion Prevention Systems (IPS) with signatures or rules tailored to detect and block SQL injection attempts targeting BOS IP cameras.