Genetec Security Center EUVD-2026-41923

Exploitation requires network reachability to the live video retrieval / stream service of a Genetec Security Center 5.14.0.0 deployment on a build earlier than 5.14.178.18; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed, so an attacker who can reach the streaming endpoint can request feeds directly. The primary limiting factor is not authentication but network exposure: Security Center video servers are typically on segmented internal security networks, so realistic exploitation depends on the attacker already having access to that network segment (insider, compromised host, or a firewall/segmentation misconfiguration that exposes the stream service). Impact is limited to confidentiality (viewing live video); the flaw does not grant control, configuration change, or disruption.

Signals are partially available and moderately consistent. The CVSS 3.1 base score is 7.5 (High) with AV:N/AC:L/PR:N/UI:N and a confidentiality-only impact (C:H/I:N/A:N), which correctly reflects that an unauthenticated network attacker can read video but cannot alter or disrupt the system through this flaw. No EPSS score, no SSVC decision, and no KEV entry were supplied, and there is no public exploit identified at time of analysis, so there is no evidence of active or automatable exploitation - this appears to be a vendor-discovered and vendor-reported issue (credited to Genetec) rather than one surfaced through in-the-wild attacks. The practical risk is gated by network reachability: Security Center video servers are normally deployed on segmented internal/security networks rather than internet-facing, which materially lowers real-world exposure despite the AV:N rating. Missing data to note explicitly: EPSS probability is absent, so the 'likelihood of exploitation' dimension cannot be quantified; KEV status is absent (treat as not-listed, not as confirmed-safe).

An attacker with network access to the Security Center video services sends a crafted video stream request that omits or spoofs the expected authentication step, and the server returns a live feed without validating the requester's identity. Because no credentials or user interaction are required (AV:N/PR:N/UI:N), an insider on the security VLAN - or anyone who can reach the streaming port through a misconfigured firewall - could silently watch camera feeds. No public exploit is identified at time of analysis, so this would require the attacker to reproduce the bypass independently.