Genetec RabbitMQ EUVD-2026-31848

Local code execution on a Windows host running one of the affected Genetec products (Genetec RabbitMQ <3.13.7.19, Mission Control <3.4.1.0, Sipelia <2.11, Industrial IoT <6.0.196.0/<5.5.118.0, Airport Operational Manager <1.6, Restricted Security Area <5.2.1, or Inter-System Gateway <1.2) is required, along with a valid low-privileged account (PR:L) able to interact with the misconfigured RabbitMQ deployment resource. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is LIMITED by the local-only attack vector (AV:L) - there is no remote network exposure of this flaw - and by the requirement that the target host have a vulnerable Genetec product version with the deployed RabbitMQ component actually installed and running.

Signals are largely consistent and point to a moderate, not urgent, real-world risk. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) indicates a local attacker with low privileges can fully compromise the host, but the local attack vector inherently limits mass exploitation. EPSS at 0.01% (2nd percentile) and CISA SSVC scoring Exploitation as 'none' and Automatable as 'no' reinforce that this is not a worm-class or remotely-triggered flaw - though Technical Impact is rated 'total', confirming the post-exploitation severity. It is not on the CISA KEV list and no public exploit was identified. Practical risk is highest for environments where Genetec products run on multi-user hosts or where an attacker has already obtained a low-privileged foothold and is seeking lateral movement or SYSTEM-level pivots inside a physical security infrastructure - a high-value target context that should drive prioritization despite the modest EPSS.

An attacker who has obtained a low-privileged shell on a Genetec server - for example via phishing an operator, abusing a weak service account, or leveraging an unrelated foothold - locates the misconfigured RabbitMQ resource and writes a malicious DLL, configuration file, or script that is loaded or executed by the RabbitMQ service running at SYSTEM or an elevated service account. Execution of that payload yields full host compromise, enabling the attacker to pivot into the broader physical security environment (cameras, access control, mission control workflows). No public proof-of-concept has been identified at time of analysis.