CVE-2025-43027 (GCVE-0-2025-43027)
Vulnerability from cvelistv5
Published
2025-10-30 14:12
Modified
2025-10-31 03:55
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-284 - Improper Access Control
Summary
A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.
References
Impacted products
Vendor Product Version
Genetec Inc. Genetec Security Center Version: <5.9.5.10   ≤
Version: >=5.10.0.0 <5.10.4.29   ≤
Version: >=5.11.0.0 <5.11.3.25   ≤
Version: >=5.12.0.0 <5.12.2.12   ≤
Version: >=5.13.0.0 <5.13.2.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-43027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-30T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-31T03:55:30.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Genetec Security Center",
          "vendor": "Genetec Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003e=5.9.5.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003c5.9.5.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.10.4.29",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.10.0.0 \u003c5.10.4.29",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.11.3.25",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.11.0.0 \u003c5.11.3.25",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.12.2.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.12.0.0 \u003c5.12.2.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.13.2.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.13.0.0 \u003c5.13.2.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115: Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T14:26:32.672Z",
        "orgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8",
        "shortName": "Genetec"
      },
      "references": [
        {
          "url": "https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center"
        },
        {
          "url": "https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in Security Center 5.13.2.3, 5.12.2.12, 5.11.3.25, 5.10.4.29, 5.9.5.10 and all later versions. Customers running an affected version of Security Center should apply the latest update as soon as possible. Customers not using AutoVu automatic license plate recognition (ALPR) should deactivate the ALPR Manager role. You can find out how by searching Deactivating and activating roles in the TechDoc Hub."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "If the ALPR Manager role must be used and the Security Center instance cannot be updated promptly, the system administrator should reduce exposure to the system. This can be done by restricting network access to trusted sources and enforcing secure connectivity measures, such as VPN or equivalent controls."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8",
    "assignerShortName": "Genetec",
    "cveId": "CVE-2025-43027",
    "datePublished": "2025-10-30T14:12:27.918Z",
    "dateReserved": "2025-04-16T14:08:47.338Z",
    "dateUpdated": "2025-10-31T03:55:30.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-43027\",\"sourceIdentifier\":\"security@genetec.com\",\"published\":\"2025-10-30T15:15:37.440\",\"lastModified\":\"2025-11-04T15:41:56.843\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@genetec.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@genetec.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center\",\"source\":\"security@genetec.com\"},{\"url\":\"https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center\",\"source\":\"security@genetec.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-43027\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-30T19:11:58.631028Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-30T19:12:02.802Z\"}}], \"cna\": {\"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115: Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Genetec Inc.\", \"product\": \"Genetec Security Center\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"\u003e=5.9.5.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"\u003c5.9.5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"\u003e=5.10.4.29\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"\u003e=5.10.0.0 \u003c5.10.4.29\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"\u003e=5.11.3.25\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"\u003e=5.11.0.0 \u003c5.11.3.25\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"\u003e=5.12.2.12\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"\u003e=5.12.0.0 \u003c5.12.2.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"\u003e=5.13.2.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"\u003e=5.13.0.0 \u003c5.13.2.3\", \"versionType\": \"semver\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"This issue is fixed in Security Center 5.13.2.3, 5.12.2.12, 5.11.3.25, 5.10.4.29, 5.9.5.10 and all later versions. Customers running an affected version of Security Center should apply the latest update as soon as possible. Customers not using AutoVu automatic license plate recognition (ALPR) should deactivate the ALPR Manager role. You can find out how by searching Deactivating and activating roles in the TechDoc Hub.\"}], \"references\": [{\"url\": \"https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center\"}, {\"url\": \"https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If the ALPR Manager role must be used and the Security Center instance cannot be updated promptly, the system administrator should reduce exposure to the system. This can be done by restricting network access to trusted sources and enforcing secure connectivity measures, such as VPN or equivalent controls.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"f2b06212-cb4b-41a4-9501-fa2e367495b8\", \"shortName\": \"Genetec\", \"dateUpdated\": \"2025-10-30T14:26:32.672Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-43027\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-31T03:55:30.389Z\", \"dateReserved\": \"2025-04-16T14:08:47.338Z\", \"assignerOrgId\": \"f2b06212-cb4b-41a4-9501-fa2e367495b8\", \"datePublished\": \"2025-10-30T14:12:27.918Z\", \"assignerShortName\": \"Genetec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.