CVE-2025-26263

CVE-2025-26263 - GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less, is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.

Requirements

To perform successful attack an attacker requires:

• System level access to the GV-ASManager windows desktop application with the version 6.1.2.0 or less;
• A high privilege account to dump the memory.

Impact

The vulnerability can be leveraged to perform the following unauthorized actions:

• An attacker with high privilege system user, who isn't authorized to access GeoVision ASManager, is able to:
  • Dump ASManager accounts credentials;
  • Authenticate in ASManager.
• After the authenticating in ASManager, an attacker will be able to:
  • Access the resources such as monitoring cameras, access cards, parking cars, employees and visitors, etc.
  • Make changes in data and service network configurations such as employees, access card security information, IP addresses and configurations, etc.
  • Disrupt and disconnect services such as monitoring cameras, access controls.
  • Clone and duplicate access control data for further attack scenarios.

CVE-2025-26263 PoC [Testing GeoVision v6.1.2.0]

Credentials leakage in memory can be dumped and found with two methods: • Account which has been authenticated in the software at least once; • Account has never been authenticated in the software, but an attacker is able to trigger memory allocation by triggering it with "Forget Password?" function;