CVE-2025-43027

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43027", "assignerOrgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "state": "PUBLISHED", "assignerShortName": "Genetec", "dateReserved": "2025-04-16T14:08:47.338Z", "datePublished": "2025-10-30T14:12:27.918Z", "dateUpdated": "2026-02-26T16:56:48.627Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "shortName": "Genetec", "dateUpdated": "2025-10-30T14:26:32.672Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "affected": [{"vendor": "Genetec Inc.", "product": "Genetec Security Center", "platforms": ["Windows"], "versions": [{"status": "unaffected", "versionType": "semver", "version": ">=5.9.5.10"}, {"status": "affected", "versionType": "semver", "version": "<5.9.5.10"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.10.4.29"}, {"status": "affected", "versionType": "semver", "version": ">=5.10.0.0 <5.10.4.29"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.11.3.25"}, {"status": "affected", "versionType": "semver", "version": ">=5.11.0.0 <5.11.3.25"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.12.2.12"}, {"status": "affected", "versionType": "semver", "version": ">=5.12.0.0 <5.12.2.12"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.13.2.3"}, {"status": "affected", "versionType": "semver", "version": ">=5.13.0.0 <5.13.2.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "solutions": [{"lang": "en", "value": "This issue is fixed in Security Center 5.13.2.3, 5.12.2.12, 5.11.3.25, 5.10.4.29, 5.9.5.10 and all later versions. Customers running an affected version of Security Center should apply the latest update as soon as possible. Customers not using AutoVu automatic license plate recognition (ALPR) should deactivate the ALPR Manager role. You can find out how by searching Deactivating and activating roles in the TechDoc Hub."}], "workarounds": [{"lang": "en", "value": "If the ALPR Manager role must be used and the Security Center instance cannot be updated promptly, the system administrator should reduce exposure to the system. This can be done by restricting network access to trusted sources and enforcing secure connectivity measures, such as VPN or equivalent controls."}], "references": [{"url": "https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center"}, {"url": "https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-43027", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T03:55:30.850202Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:56:48.627Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43027", "assignerOrgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "state": "PUBLISHED", "assignerShortName": "Genetec", "dateReserved": "2025-04-16T14:08:47.338Z", "datePublished": "2025-10-30T14:12:27.918Z", "dateUpdated": "2026-02-26T16:56:48.627Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8", "shortName": "Genetec", "dateUpdated": "2025-10-30T14:26:32.672Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "affected": [{"vendor": "Genetec Inc.", "product": "Genetec Security Center", "platforms": ["Windows"], "versions": [{"status": "unaffected", "versionType": "semver", "version": ">=5.9.5.10"}, {"status": "affected", "versionType": "semver", "version": "<5.9.5.10"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.10.4.29"}, {"status": "affected", "versionType": "semver", "version": ">=5.10.0.0 <5.10.4.29"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.11.3.25"}, {"status": "affected", "versionType": "semver", "version": ">=5.11.0.0 <5.11.3.25"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.12.2.12"}, {"status": "affected", "versionType": "semver", "version": ">=5.12.0.0 <5.12.2.12"}, {"status": "unaffected", "versionType": "semver", "version": ">=5.13.2.3"}, {"status": "affected", "versionType": "semver", "version": ">=5.13.0.0 <5.13.2.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "solutions": [{"lang": "en", "value": "This issue is fixed in Security Center 5.13.2.3, 5.12.2.12, 5.11.3.25, 5.10.4.29, 5.9.5.10 and all later versions. Customers running an affected version of Security Center should apply the latest update as soon as possible. Customers not using AutoVu automatic license plate recognition (ALPR) should deactivate the ALPR Manager role. You can find out how by searching Deactivating and activating roles in the TechDoc Hub."}], "workarounds": [{"lang": "en", "value": "If the ALPR Manager role must be used and the Security Center instance cannot be updated promptly, the system administrator should reduce exposure to the system. This can be done by restricting network access to trusted sources and enforcing secure connectivity measures, such as VPN or equivalent controls."}], "references": [{"url": "https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center"}, {"url": "https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-43027", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T03:55:30.850202Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T19:12:02.802Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Genetec Security Center", "vendor": "Genetec Inc.", "versions": [{"status": "unaffected", "version": ">=5.9.5.10", "versionType": "semver"}, {"status": "affected", "version": "<5.9.5.10", "versionType": "semver"}, {"status": "unaffected", "version": ">=5.10.4.29", "versionType": "semver"}, {"status": "affected", "version": ">=5.10.0.0 <5.10.4.29", "versionType": "semver"}, {"status": "unaffected", "version": ">=5.11.3.25", "versionType": "semver"}, {"status": "affected", "version": ">=5.11.0.0 <5.11.3.25", "versionType": "semver"}, {"status": "unaffected", "version": ">=5.12.2.12", "versionType": "semver"}, {"status": "affected", "version": ">=5.12.0.0 <5.12.2.12", "versionType": "semver"}, {"status": "unaffected", "version": ">=5.13.2.3", "versionType": "semver"}, {"status": "affected", "version": ">=5.13.0.0 <5.13.2.3", "versionType": "semver"}]}], "source": "security@genetec.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild."}, {"lang": "es", "value": "Una vulnerabilidad de gravedad cr\u00edtica ha sido identificada en el rol de Administrador ALPR de Security Center que podr\u00eda permitir a atacantes obtener acceso administrativo al sistema Genetec Security Center. El equipo de ingenier\u00eda de Genetec descubri\u00f3 este problema internamente. Actualmente no hay evidencia de que esta vulnerabilidad haya sido explotada en la naturaleza."}], "id": "CVE-2025-43027", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@genetec.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43027", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T03:55:30.850202Z", "version": "2.0.3"}}]}, "published": "2025-10-30T15:15:37.440", "references": [{"source": "security@genetec.com", "url": "https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center"}, {"source": "security@genetec.com", "url": "https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center"}], "sourceIdentifier": "security@genetec.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@genetec.com", "type": "Secondary"}]}

{}

{"created": "2025-10-31T10:14:07.147776+00:00", "updated": "2025-10-31T10:14:07.147801+00:00", "vendors": ["genetec", "genetec$PRODUCT$security_center"]}