ZDI-CAN-25394: ZDI-24-1682: GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2024-12553.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-25394?
The severity of ZDI-CAN-25394 is classified as a medium risk vulnerability due to its potential for sensitive information disclosure.
How do I fix ZDI-CAN-25394?
To fix ZDI-CAN-25394, ensure that default guest credentials are changed and apply the latest security patches provided by GeoVision.
What software is impacted by ZDI-CAN-25394?
ZDI-CAN-25394 affects GeoVision GV-ASManager installations.
Can ZDI-CAN-25394 be exploited without authentication?
ZDI-CAN-25394 requires authentication to exploit, but it can be accessed using default guest credentials.
What type of information can be disclosed due to ZDI-CAN-25394?
ZDI-CAN-25394 can potentially disclose sensitive information stored in affected installations of GeoVision GV-ASManager.