CVE-2025-43027 (GCVE-0-2025-43027)

Vulnerability from cvelistv5 – Published: 2025-10-30 14:12 – Updated: 2026-02-26 16:56
VLAI KEVIntel
Summary
A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Genetec Inc. Genetec Security Center Unaffected: >=5.9.5.10 (semver)
Affected: <5.9.5.10 (semver)
Unaffected: >=5.10.4.29 (semver)
Affected: >=5.10.0.0 <5.10.4.29 (semver)
Unaffected: >=5.11.3.25 (semver)
Affected: >=5.11.0.0 <5.11.3.25 (semver)
Unaffected: >=5.12.2.12 (semver)
Affected: >=5.12.0.0 <5.12.2.12 (semver)
Unaffected: >=5.13.2.3 (semver)
Affected: >=5.13.0.0 <5.13.2.3 (semver)
Create a notification for this product.
KEVIntel
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: b5a5c214-48ed-4ff3-a734-c536eee99ec4

Vulnerability ID: CVE-2025-43027

Status: Confirmed

Status Updated: 2026-06-01 10:43 UTC

Exploited: Yes

Timestamps
First Seen: 2026-06-01
Asserted: 2026-06-01
Scope
Notes: KEVIntel entry: A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative... | Affected: Genetec Inc. / Genetec Security Center | CVSS: 9.8 (CRITICAL) | EPSS: 0.00302 | Used in malware: unknown | Not yet in CISA KEV: True
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative...
Vendor Genetec Inc.
Product Genetec Security Center
Added Date 2026-06-01T10:43:11.614Z
Cvss Score 9.8
Epss Score 0.00302
Cvss Severity CRITICAL
Epss Percentile 0.2167
Used In Malware unknown
Ahead Of Cisa Kev None
Not Yet In Cisa Kev True
References
Created: 2026-06-19 12:42 UTC | Updated: 2026-06-19 12:42 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-43027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-31T03:55:30.850202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:56:48.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Genetec Security Center",
          "vendor": "Genetec Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003e=5.9.5.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003c5.9.5.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.10.4.29",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.10.0.0 \u003c5.10.4.29",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.11.3.25",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.11.0.0 \u003c5.11.3.25",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.12.2.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.12.0.0 \u003c5.12.2.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "\u003e=5.13.2.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "\u003e=5.13.0.0 \u003c5.13.2.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115: Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T14:26:32.672Z",
        "orgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8",
        "shortName": "Genetec"
      },
      "references": [
        {
          "url": "https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center"
        },
        {
          "url": "https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in Security Center 5.13.2.3, 5.12.2.12, 5.11.3.25, 5.10.4.29, 5.9.5.10 and all later versions. Customers running an affected version of Security Center should apply the latest update as soon as possible. Customers not using AutoVu automatic license plate recognition (ALPR) should deactivate the ALPR Manager role. You can find out how by searching Deactivating and activating roles in the TechDoc Hub."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "If the ALPR Manager role must be used and the Security Center instance cannot be updated promptly, the system administrator should reduce exposure to the system. This can be done by restricting network access to trusted sources and enforcing secure connectivity measures, such as VPN or equivalent controls."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2b06212-cb4b-41a4-9501-fa2e367495b8",
    "assignerShortName": "Genetec",
    "cveId": "CVE-2025-43027",
    "datePublished": "2025-10-30T14:12:27.918Z",
    "dateReserved": "2025-04-16T14:08:47.338Z",
    "dateUpdated": "2026-02-26T16:56:48.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-43027",
      "date": "2026-06-26",
      "epss": "0.00302",
      "percentile": "0.21823"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-43027\",\"sourceIdentifier\":\"security@genetec.com\",\"published\":\"2025-10-30T15:15:37.440\",\"lastModified\":\"2025-11-04T15:41:56.843\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@genetec.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@genetec.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center\",\"source\":\"security@genetec.com\"},{\"url\":\"https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center\",\"source\":\"security@genetec.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"f2b06212-cb4b-41a4-9501-fa2e367495b8\", \"shortName\": \"Genetec\", \"dateUpdated\": \"2025-10-30T14:26:32.672Z\"}, \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\", \"type\": \"CWE\"}]}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115: Authentication Bypass\"}]}], \"affected\": [{\"vendor\": \"Genetec Inc.\", \"product\": \"Genetec Security Center\", \"platforms\": [\"Windows\"], \"versions\": [{\"status\": \"unaffected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.9.5.10\"}, {\"status\": \"affected\", \"versionType\": \"semver\", \"version\": \"\u003c5.9.5.10\"}, {\"status\": \"unaffected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.10.4.29\"}, {\"status\": \"affected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.10.0.0 \u003c5.10.4.29\"}, {\"status\": \"unaffected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.11.3.25\"}, {\"status\": \"affected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.11.0.0 \u003c5.11.3.25\"}, {\"status\": \"unaffected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.12.2.12\"}, {\"status\": \"affected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.12.0.0 \u003c5.12.2.12\"}, {\"status\": \"unaffected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.13.2.3\"}, {\"status\": \"affected\", \"versionType\": \"semver\", \"version\": \"\u003e=5.13.0.0 \u003c5.13.2.3\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"solutions\": [{\"lang\": \"en\", \"value\": \"This issue is fixed in Security Center 5.13.2.3, 5.12.2.12, 5.11.3.25, 5.10.4.29, 5.9.5.10 and all later versions. Customers running an affected version of Security Center should apply the latest update as soon as possible. Customers not using AutoVu automatic license plate recognition (ALPR) should deactivate the ALPR Manager role. You can find out how by searching Deactivating and activating roles in the TechDoc Hub.\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If the ALPR Manager role must be used and the Security Center instance cannot be updated promptly, the system administrator should reduce exposure to the system. This can be done by restricting network access to trusted sources and enforcing secure connectivity measures, such as VPN or equivalent controls.\"}], \"references\": [{\"url\": \"https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center\"}, {\"url\": \"https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center\"}]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-43027\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-31T03:55:30.850202Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-30T19:12:02.802Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-43027\", \"assignerOrgId\": \"f2b06212-cb4b-41a4-9501-fa2e367495b8\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Genetec\", \"dateReserved\": \"2025-04-16T14:08:47.338Z\", \"datePublished\": \"2025-10-30T14:12:27.918Z\", \"dateUpdated\": \"2026-02-26T16:56:48.627Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.