Senstar Symphony CVE-2025-12491
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Symphony service over network
-
ExploitInvoke FetchStoredLicense method unauthenticated
-
ExecutionReceive exposed stored credentials
-
ImpactReuse credentials for further compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Senstar Symphony server exposing the FetchStoredLicense method; per the CVSS vector and description (PR:N, UI:N), no authentication and no user interaction are needed, so default network-exposed installations are directly at risk. The practical limiting factor is network exposure - Symphony is typically a server-side video management platform deployed on internal or segmented physical-security networks, so reachability depends on whether the management service is exposed beyond that segment. No specific non-default feature toggle or configuration prerequisite is identified in the available data; the only stated requirement is the ability to invoke the vulnerable method. |
| Impact | Signals are moderate and largely consistent. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - a classic information-disclosure profile matching CWE-200 and the ZDI description. The description's claim of 'Authentication is not required' is corroborated by PR:N, so the auth signal is confirmed by the vector. Against this, the EPSS score is low (0.64%, ~50th percentile), indicating no statistical evidence of broad exploitation activity, and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. No public exploit code is referenced - only a ZDI advisory (ZDI-25-1060, formerly ZDI-CAN-26908) reported by Trend Micro ZDI. The real amplifier here is not probability but consequence: the disclosed data is 'stored credentials,' which turns a single read primitive into a pivot for follow-on compromise, so the effective risk exceeds what a pure read-only bug would imply. Net: a genuine, patch-worthy HIGH for organizations actually running Senstar Symphony, but not an emergency 'exploit-now' item - EPSS and the absence of KEV/POC suggest it is not yet being exploited at scale. No contradictory signals were found between the vector and the description. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Senstar Symphony server over the network invokes the FetchStoredLicense method and receives sensitive data back, including stored credentials. The attacker reuses those harvested credentials to authenticate to Symphony or connected systems and expand access. No public exploit code or active exploitation is identified at time of analysis, so this reflects the CVSS AV:N/AC:L/PR:N capability rather than an observed campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Unauthenticated remote attackers can retrieve stored credentials from Senstar Symphony by invoking the FetchStoredLicense method, which returns sensitive license-related data without requiring authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5). The exposure is confidentiality-only but high impact: leaked credentials can be reused to pivot further into the video management deployment and its integrated systems. EPSS is 0.64% (50th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV; the practical risk driver is whether the Symphony management service is reachable from untrusted networks.
RemediationAI
No vendor-released patch is identified in the available data at time of analysis; the primary action is to confirm fix status with Senstar support and monitor ZDI advisory ZDI-25-1060 (https://www.zerodayinitiative.com/advisories/ZDI-25-1060/) for an update, then upgrade to the vendor-designated fixed build once published. Until then, the most effective control is to remove network reachability: firewall or segment the Symphony management service so only trusted administrative hosts, a VPN, or a jump host can reach it, accepting that this restricts remote administration and may require re-architecting remote access workflows. Where a reverse proxy or WAF fronts the service, block or restrict requests that invoke the FetchStoredLicense method and log attempts, with the trade-off that legitimate license-management functionality may break and proxy rules must be maintained as the API evolves. Because the flaw exposes stored credentials, treat any Symphony instance that was network-exposed as potentially compromised: rotate credentials and secrets stored in or returned by the license mechanism, and review authentication logs for unexpected or anomalous calls to the license method. Do not rely on authentication requirements as a mitigation, since the CVSS vector confirms PR:N and no user interaction (UI:N).
Affected ProductsAI
Senstar Symphony installations that expose the FetchStoredLicense method to network clients are affected; the CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms the vulnerable path is remotely reachable without credentials or user interaction. The available intelligence does not include CPE strings or an explicit version range, so the exact affected releases cannot be enumerated here; consult the Zero Day Initiative advisory ZDI-25-1060 (https://www.zerodayinitiative.com/advisories/ZDI-25-1060/), tied to case ZDI-CAN-26908 and reported by Trend Micro ZDI, for the vendor-confirmed product and version details. Administrators should treat any Symphony deployment with a network-reachable management interface as potentially exposed until Senstar confirms applicability.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) case in Senstar Symphony, a server-based video management platform used in physical-security environments. The FetchStoredLicense method returns stored license data, but its implementation includes sensitive material - reportedly stored credentials - rather than sanitized license metadata, and it is callable without authentication. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, the weakness is a straightforward unauthenticated network information leak with no integrity or availability impact, meaning exploitation is quiet and does not disrupt the platform. The root cause class is improper handling and disclosure of secrets in an API/service response: sensitive values are neither filtered from the output nor protected by an authorization check. No CPE strings were supplied in the available intelligence, so the precise affected build range cannot be pinned from the feed; the ZDI advisory (ZDI-25-1060, tracking ZDI-CAN-26908) is the authoritative technical source. Realistically, the limiting factor is deployment architecture - Symphony servers usually sit on segmented internal security networks, so the attack surface depends on whether the management service is exposed beyond that segment.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description and ZDI advisory confirm unauthenticated network access (AV:N/PR:N/UI:N) to a method leaking stored credentials (C:H), with no integrity or availability effect (I:N/A:N).
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Senstar Symphony FetchStoredLicense Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Senstar Symphony. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of FetchStoredLicense method. The issue results from the exposure of sensitive information. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26908.
Executive ViewAI
Senstar Symphony's license retrieval function can expose stored credentials to unauthenticated remote users, potentially allowing attackers to access the video management platform and connected systems. No public exploit identified at time of analysis, but because no vendor-released patch is identified, risk hinges on whether the Symphony management service is reachable from untrusted networks. Security leadership should prioritize reducing exposure of Symphony management interfaces and treating leaked credentials as a potential pathway to broader physical-security system compromise.
No vendor-released patch identified at time of analysis; restrict network access to Senstar Symphony management services, block the FetchStoredLicense method at the perimeter, segment the VMS from untrusted networks, rotate stored credentials, and monitor for anomalous access to license or credential data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB