CVE-2020-3929 - GeoVision Door Access Control Device - Shared cryptographic keys

Back Back to CVE browser

MEDIUM

GeoVision Door Access Control Device - Shared cryptographic keys

Published Jun 12, 2020

5.9

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.

Affected products

Vendor GeoVision Product Door Access Control Device Default
n/a
- Version
  GV-AS1010
  Status
  affected
  Constraints
  <=1.32
- Version
  GV-AS210
  Status
  affected
  Constraints
  <=2.21
- Version
  GV-AS410
  Status
  affected
  Constraints
  <=2.21
- Version
  GV-AS810
  Status
  affected
  Constraints
  <=2.21
- Version
  GV-GF192x
  Status
  affected
  Constraints
  <=1.10

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GeoVision

Door Access Control Device

n/a

Version	Status	Constraints
GV-AS1010	affected	<=1.32
GV-AS210	affected	<=2.21
GV-AS410	affected	<=2.21
GV-AS810	affected	<=2.21
GV-GF192x	affected	<=1.10

Remediation

Vendor solution

Update to version 2.22 in GV-AS210 Update to version 2.22 in GV-AS410 Update to version 2.22 in GV-AS810 Update to version 1.22 in GV-GF192x Update to version 1.33 in GV-AS1010

Weaknesses (1)

CWE-326

Inadequate Encryption Strength

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25194
Advisory
https://www.twcert.org.tw/tw/cp-132-3696-6601c-1.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25194		Advisory
https://www.twcert.org.tw/tw/cp-132-3696-6601c-1.html		x_refsource_MISCThird Party Advisory