EUVD-2026-67296
GHSA-jm53-72rw-4gm2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Local access and low privileges sufficient to read installation folder; scope change reflects cross-component impact potential within physical access control infrastructure.
Primary rating from Vendor (Genetec).
CVSS VectorVendor: Genetec
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synergis Softwire installed on Windows servers.
AnalysisAI
Improper access control on the Synergis Softwire installation folder exposes sensitive files to any low-privileged local user on Windows Server deployments and Genetec Streamvault SV-100E and SV-300E all-in-one appliances. The CVSS scope change (S:C) is particularly consequential in this context: Synergis Softwire is a physical access control server, meaning credentials or configuration material extracted from the installation directory could allow an attacker to manipulate physical security decisions or pivot into backend systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated interactive session on the Synergis Softwire host - via physical console, RDP, or equivalent remote desktop mechanism - using a Windows account with at minimum low (standard user-level) privileges, as confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.9 score reflects a realistic, low-friction attack against a high-value target: attack complexity is low, no user interaction is required, and only a low-privileged local account is needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Synergis Softwire to version 12.0.2 (12.0.x branch) or 12.2.0 (12.2.x branch) per Genetec vendor advisories at https://techdocs.genetec.com/r/en-US/Security-Updates-for-SynergisTM-Softwire-12.0/Resolved-vulnerabilities-in-Synergis-Softwire-12.0.2 and https://techdocs.genetec.com/r/en-US/Security-Updates-for-SynergisTM-Softwire-12.2/Resolved-vulnerabilities-in-Synergis-Softwire-12.2.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Synergis Softwire and Genetec Streamvault deployments; review access logs for suspicious local user activity in installation directories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-922 – Insecure Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today