CVE-2025-1787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1787", "assignerOrgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "state": "PUBLISHED", "assignerShortName": "Genetec", "dateReserved": "2025-02-28T17:05:57.628Z", "datePublished": "2026-02-24T18:44:36.705Z", "dateUpdated": "2026-02-26T14:44:07.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "shortName": "Genetec", "dateUpdated": "2026-02-24T18:44:36.705Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-200", "descriptions": [{"lang": "en", "value": "CAPEC-200: Removal of filters: Input filters, output filters, data masking"}]}], "affected": [{"vendor": "Genetec Inc.", "product": "Genetec Update Service", "platforms": ["Windows"], "versions": [{"status": "affected", "versionType": "semver", "version": "<2.10.600"}, {"status": "unaffected", "versionType": "semver", "version": ">=2.10.600"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Local admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin privileged, Windows user could exploit this vulnerability to gain elevated privileges in the Genetec Update Service. Could be combined with CVE-2025-1789 to achieve low privilege escalation."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:H/IR:H/AR:H/MVC:H/MVI:H/MVA:H/MSI:H/MSA:H/S:P/AU:N/V:C", "version": "4.0"}}], "solutions": [{"lang": "en", "value": "This issue is fixed in Genetec Update Service 2.10.600 and all later versions. Internet connected Genetec Update Service will automatically update themselves."}], "references": [{"url": "https://techdocs.genetec.com/r/en-US/Security-Updates-for-GenetecTM-Update-Service-2.10/Resolved-vulnerabilities-in-Genetec-Update-Service-2.10"}], "credits": [{"lang": "en", "type": "finder", "value": "Rutger Flohil"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:05.875817Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:07.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:05.875817Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:16:36.432Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Rutger Flohil"}], "impacts": [{"capecId": "CAPEC-200", "descriptions": [{"lang": "en", "value": "CAPEC-200: Removal of filters: Input filters, output filters, data masking"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:H/IR:H/AR:H/MVC:H/MVI:H/MVA:H/MSI:H/MSA:H/S:P/AU:N/V:C"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Genetec Inc.", "product": "Genetec Update Service", "versions": [{"status": "affected", "version": "<2.10.600", "versionType": "semver"}, {"status": "unaffected", "version": ">=2.10.600", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is fixed in Genetec Update Service 2.10.600 and all later versions. Internet connected Genetec Update Service will automatically update themselves."}], "references": [{"url": "https://techdocs.genetec.com/r/en-US/Security-Updates-for-GenetecTM-Update-Service-2.10/Resolved-vulnerabilities-in-Genetec-Update-Service-2.10"}], "descriptions": [{"lang": "en", "value": "Local admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin privileged, Windows user could exploit this vulnerability to gain elevated privileges in the Genetec Update Service. Could be combined with CVE-2025-1789 to achieve low privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "shortName": "Genetec", "dateUpdated": "2026-02-24T18:44:36.705Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1787", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:07.839Z", "dateReserved": "2025-02-28T17:05:57.628Z", "assignerOrgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "datePublished": "2026-02-24T18:44:36.705Z", "assignerShortName": "Genetec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Genetec Update Service", "vendor": "Genetec Inc.", "versions": [{"status": "affected", "version": "<2.10.600", "versionType": "semver"}, {"status": "unaffected", "version": ">=2.10.600", "versionType": "semver"}]}], "source": "security@genetec.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:genetec:genetec_update_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A7711A6-9F7D-4FFA-9B9B-BA2BF6C162C7", "versionEndExcluding": "2.10.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Local admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin privileged, Windows user could exploit this vulnerability to gain elevated privileges in the Genetec Update Service. Could be combined with CVE-2025-1789 to achieve low privilege escalation."}, {"lang": "es", "value": "El administrador local podr\u00eda filtrar informaci\u00f3n de la p\u00e1gina web de configuraci\u00f3n del Servicio de Actualizaci\u00f3n de Genetec. Un usuario de Windows autenticado y con privilegios de administrador podr\u00eda explotar esta vulnerabilidad para obtener privilegios elevados en el Servicio de Actualizaci\u00f3n de Genetec. Podr\u00eda combinarse con CVE-2025-1789 para lograr una peque\u00f1a escalada de privilegios."}], "id": "CVE-2025-1787", "lastModified": "2026-06-17T08:39:46.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:C/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@genetec.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T04:56:05.875817Z", "version": "2.0.3"}}]}, "published": "2026-02-24T20:27:42.413", "references": [{"source": "security@genetec.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://techdocs.genetec.com/r/en-US/Security-Updates-for-GenetecTM-Update-Service-2.10/Resolved-vulnerabilities-in-Genetec-Update-Service-2.10"}], "sourceIdentifier": "security@genetec.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security@genetec.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.10.600)"}}, {"platform": ["windows"], "status": "unaffected", "versions": {"scheme": "semver", "value": "[2.10.600,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Genetec Update Service", "source": "cna", "vendor": "Genetec Inc."}, "product": "update_service", "vendor": "genetec"}], "created": "2026-02-25T11:35:42.410393+00:00", "updated": "2026-02-25T11:35:42.410490+00:00", "vendors": ["genetec", "genetec$PRODUCT$update_service"]}