Genetec Security Center EUVD-2026-33946

Exploitation requires (1) the Security Center main server host to have been installed using a vulnerable installer package - not merely running a vulnerable version string, since 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0 each shipped both vulnerable and fixed installer hashes - and (2) the attacker to already hold local OS-level access to that main server host with at least low privileges (PR:L), sufficient to read the file-system artifacts produced by the installer. Limiting factors that reduce real-world risk: no network-reachable attack surface (AV:L), no remote unauthenticated path, exploitation is confined to the main server host rather than federation or client workstations, and organizations that installed using a remediated build of the same version number are not affected.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack requires local access with low (non-admin) privileges, scoring 7.8 due to the full CIA impact once Server Admin credentials are recovered - those credentials typically grant administrative control over the security platform including video, access control, and audit configuration. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis; the vendor explicitly states no evidence of active exploitation and the finder was a third party engaged by Genetec, which is consistent with a coordinated disclosure rather than in-the-wild discovery. The most important risk nuance is the build-hash ambiguity: organizations relying on version-string inventory will produce false negatives or false positives, so the real defensive priority is asset verification via installer hashes rather than rushed patching, because two hosts showing the same version may have different exposure.

A low-privileged local user on the Security Center main server - for example a backup operator, monitoring agent service account, or a contractor with RDP access - reads Server Admin credentials from a file artifact left by a vulnerable installer build and then authenticates to the Security Center Server Admin interface to disable cameras, alter access control rules, or tamper with audit trails. No public exploit identified at time of analysis, but exploitation requires only standard file-read operations against a known path once the vulnerable build is identified, making post-compromise lateral escalation straightforward.