Geovision
CVE-2024-12553
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (trendmicro) · only source for this CVE.
CVSS VectorVendor: trendmicro
Lifecycle Timeline
1DescriptionCVE.org
GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used.
The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394.
AnalysisAI
GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394. Affected products include: Geovision Gv-Asmanager.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Rated critical severity (CVSS 9.8), this vulne
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Rated critical severity
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. Rated critical
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. Rated high severity (CVSS 7.5),
A XSS found in Advan VD-1 firmware versions up to 230. Rated medium severity (CVSS 6.1), this vulnerability is remotely
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions
GV Edge Recording Manager (ERM) v2.3.1 improperly executes application components with SYSTEM-level privileges, allowing
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application. Rated critical
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute ar
Unauthenticated remote control of GeoVision GV-LPC2211 license-plate-capture cameras (firmware V1.13) is possible becaus
Authenticated ONVIF command injection in GeoVision GV-LPC2211 V1.13 allows a low-privileged network attacker to execute
OS command injection in GeoVision GV-LPC2011/LPC2211 firmware V1.13 allows an authenticated administrator to achieve roo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today