CVE-2020-3929 GeoVision Door Access Control Device - Shared cryptographic keys
Attackers can perform man-in-the-middle attacks and decrypt traffic due to shared cryptographic keys in GeoVision door access devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3929?
CVE-2020-3929 is a medium-severity vulnerability in GeoVision Door Access Control Device, published on 12 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.
Weakness: CWE-326
Which versions are affected by CVE-2020-3929?
It affects 5 products.
Products include Usavisionsys Geovision Gv-As1010 Firmware, Usavisionsys Geovision Gv-As210 Firmware, Usavisionsys Geovision Gv-As410 Firmware, Usavisionsys Geovision Gv-As810 Firmware, Usavisionsys Geovision Gv-Gf192x Firmware.
How do I fix CVE-2020-3929?
No fix has been published for CVE-2020-3929 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-3929 being exploited?
There is no known exploitation of CVE-2020-3929 in the wild and no public exploit code.
Other vulnerabilities in GeoVision Door Access Control Device
Sources
Also known as GHSA-pqc7-3qg5-vwc6.