CVE-2020-3928 : GeoVision Door Access Control device family is hardcoded with a root password, w

GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.

Published 2020-06-12 09:15:10

Updated 2020-06-18 12:36:17

Source TWCERT/CC

View at NVD, CVE.org

Products affected by CVE-2020-3928

Usavisionsys » Geovision Gv-as210 Firmware
Versions before (<) 2.21
cpe:2.3:o:usavisionsys:geovision_gv-as210_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Usavisionsys » Geovision Gv-as210 » Version: N/A
Usavisionsys » Geovision Gv-as410 Firmware
Versions before (<) 2.21
cpe:2.3:o:usavisionsys:geovision_gv-as410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Usavisionsys » Geovision Gv-as410 » Version: N/A
Usavisionsys » Geovision Gv-as810 Firmware
Versions before (<) 2.21
cpe:2.3:o:usavisionsys:geovision_gv-as810_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Usavisionsys » Geovision Gv-as810 » Version: N/A
Usavisionsys » Geovision Gv-as1010 Firmware
Versions before (<) 1.32
cpe:2.3:o:usavisionsys:geovision_gv-as1010_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Usavisionsys » Geovision Gv-as1010 » Version: N/A
Usavisionsys » Geovision Gv-gf192x Firmware
Versions before (<) 1.10
cpe:2.3:o:usavisionsys:geovision_gv-gf192x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Usavisionsys » Geovision Gv-gf192x » Version: N/A

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 63 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	2.5	3.6	TWCERT/CC
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

https://www.twcert.org.tw/tw/cp-132-3695-9e72d-1.html

TWCERT/CC台灣電腦網路危機處理暨協調中心-資安服務-台灣漏洞揭露平台 (TVN)-TVN (Taiwan Vulnerability Note) 漏洞公告-GeoVision 門禁控制設備 - Hardcoded privileged password vulnerability
Third Party Advisory

Jump to