TI-2025-30957 Aliases CVE-2025-48735 GHSA-8w5g-q885-39xw

SQL injection in BOS IP camera

LOW 20CWE-89Published 2025-05-23 · Updated 2025-05-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote attackers to obtain sensitive information from the database via crafted input in the request body.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00345 28th percentileScored 2026-11-07

Fix Fixed IP camera (BOS): 21.45.8.2.3_230220

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BOS	IP camera	21.45.8.2.2_220219 to before 21.45.8.2.3_230220	21.45.8.2.3_230220	Patch available	CNA

IP camera VendorBOS Affected 21.45.8.2.2_220219 to before 21.45.8.2.3_230220 Fixed in 21.45.8.2.3_230220 Patch available CNA

Remediation

Fix · CNA IP camera (BOS) Fixed in 21.45.8.2.3_230220

Timeline

2026-10-02 Threatist record created from CVE-2025-48735
2026-10-03 Alias added: GHSA-8w5g-q885-39xw

References

Other 1

https://bositaly.it/wp-content/uploads/2025/04/CAMERA-VULNERABILITY-REPORT-SQL-INJECTION.pdf

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences