What’s Vulnerable › Vulnerabilities

CVE-2020-3929: GeoVision Door Access Control Device - Shared cryptographic keys

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-12 · updated 2026-06-17
• Weakness: CWE-326

Description

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.

Affected products

• Usavisionsys Geovision Gv-As1010 Firmware: before 1.32 — fixed in 1.32
• Usavisionsys Geovision Gv-As210 Firmware: before 2.21 — fixed in 2.21
• Usavisionsys Geovision Gv-As410 Firmware: before 2.21 — fixed in 2.21
• Usavisionsys Geovision Gv-As810 Firmware: before 2.21 — fixed in 2.21
• Usavisionsys Geovision Gv-Gf192X Firmware: before 1.10 — fixed in 1.10

How to fix

Upgrade to a fixed version: Usavisionsys Geovision Gv-As1010 Firmware 1.32; Usavisionsys Geovision Gv-As210 Firmware 2.21; Usavisionsys Geovision Gv-As410 Firmware 2.21; Usavisionsys Geovision Gv-As810 Firmware 2.21; Usavisionsys Geovision Gv-Gf192X Firmware 1.10. Check the vendor advisory for mitigations.

References

• https://www.twcert.org.tw/tw/cp-132-3696-6601c-1.html
• https://www.twcert.org.tw/tw/cp-132-3696-6601c-1.html

Get alerted when CVE-2020-3929 or the next vulnerability affects your stack