GeoVision ASManager Windows Credentials Disclosure Vulnerability

A vulnerability in the GeoVision ASManager Windows desktop application, specifically in versions through 6.1.2.0, has been identified. This vulnerability allows for the unauthorized disclosure of credentials due to improper memory management in the ASManagerService.exe process. An attacker with system-level access and a high-privilege account can exploit this issue to dump memory and retrieve ASManager account credentials, which can then be used to authenticate and access various resources and functionalities within the application.

Impact

Exploitation of this vulnerability can lead to unauthorized access to ASManager accounts by allowing an attacker to retrieve and use account credentials. Once authenticated, the attacker can access and manipulate sensitive resources such as camera feeds, access control data, and network configurations, as well as disrupt services by disconnecting or disrupting monitored systems.

Reproduction

To reproduce this vulnerability, an attacker must have system-level access to a machine running GeoVision ASManager version 6.1.2.0 or earlier. The attacker needs a high-privilege account to dump the application's memory. After dumping the memory, the attacker can search for leaked credentials, which may include passwords for accounts that have been authenticated in the software or accounts that have never been authenticated but can trigger memory allocation using the 'Forget Password?' function.

Remediation

Users can update to GeoVision ASManager version 6.2.0 or later, where this vulnerability has been fixed.