Missing Authentication for Critical Function Survision License Plate Recognition Camera
The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check.
Survision has released the following versions for users to update to:
* License Plate Recognition LPR Camera: Firmware version v3.5
Survision recommends users to enable the configuration password authentication by defining users and roles with minimal rights in the user management system and, where possible, enforce client certificate authentication.
For future deployments, plan for integration of the new login/password mechanism and update your installation procedures accordingly.
* On previous versions (inferior to 3.5)
Survision recommends activating the "lock" password in the security parameters and, where possible, enforce client certificate authentication.
For more information, contact Survision https://survisiongroup.com/post-contact .
Configurations
Workarounds
Exploits
Credits
finder
Souvik Kandar of Microsec (microsec.io) reported this vulnerability to CISA.