CVE-2024-12553: GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-13 · updated 2026-06-17
Weakness: CWE-862

Description

GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394.

Affected products

GeoVision Inc. GV-ASManager: 6.1.0

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1682/

Get alerted when CVE-2024-12553 or the next vulnerability affects your stack