Genetec Self-Discloses Critical Vulnerability

By: Sean Patton, Published on Jul 31, 2018

In an unprecedented move for the video surveillance industry, Genetec has self-disclosed a critical software vulnerability across Security Center and Stratocast.

In this report we examine:

  • What the vulnerability is
  • What versions it impacts
  • Why they have released limited details
  • Why they disclosed it publicly even though no third party forced them to
  • Genetec's criticism of Chinese manufacturers / Hikvision vs their own critical vulnerability

** ** ************* **** for *** ***** ************ industry, ******* *******-********* * ******** ******** vulnerability****** ******** ****** *** Stratocast.

** **** ****** ** examine:

  • **** *** ************* **
  • **** ******** ** *******
  • *** **** **** ******** limited *******
  • *** **** ********* ** publicly **** ****** ** third ***** ****** **** to
  • *******'* ********* ** ******* manufacturers / ********* ** their *** ******** *************

[***************]

Critical *************

******* ****** *** ************* had * **** **.* base ***** ** *.* (Critical).********* ** *** **** Base ***** **********, * **** *.* score ********* **** ********* network ******, ** ***********, and * *** ********** of ******.

***********, ******* ****:

**** ************* ******* ******** Center ******* ** ******** received **** *** *******. An ******* *** ** achieved **** ****** *** attacker ** *** ************* in ******** ******. *** exploit ***** ***** *** execution ** ********* **** and **** ******* ** the ********* ****** ******* the ******** ****** ****.

*** ************* *** ********** in ******** ****** *.* (released ~****) **** ************* could **** **** ********* for * ***** ****** it *** **********. ******* says **** **** ** reports ** ******* *** that **** ********** ** recently **** * "***** party ************ ***** ** Genetec ** ******* *********** tests" ******** ** ** them.

No ************* *******

*******'* ********** **** *** include ********* ******* *** a ***** ** ******* exploiting *** *************. **** is ******** *** *************** discovered *** ******** ** independent ******** *********** (*.*.,**** ************* *********).

A **** ****-**********

*********, ** * ******** such ** *******'*, ***** they **** *** *********** tester, *** ************* ***** be ******* *******, **** no ****** ****** *** the ****** ***** ** NDA ******* **** **** public *******, ********* ** various **** *******.

** ** **** *** companies ** ****-******** ** Genetec ***, ** ******* instance ************* ********* * ******* password ***************** ****. *********'* ********** was * **** ***** level ******** *****, **** affecting **, ********* *** Express, *** *** ********* control ** *** ********* system ** *** ******. It **** *** *** require * ******** ******, just ******** *** ******* user ** ******** *** password ** *** *******.

******* ** ** ** rare *** ************* ** self-disclose, ** * ********** ****** ** ********** Responsibility, *********** ********* **** would *** ***** ************* to ****-******** ******** ******.

Notification *****

******* **** ** ***** that ********* *** **** information ** *** ********** on ***** *******.

No ******* *********

******* ********* ** **** why **** *** *** sharing **** *******:

** ****** ** ******** the ************* ******** ** maximize *** ******* **** our ********* ****** ***** of ** *** ***** the *******. ** ** also ** **** **** the ************* ********** **** practices ********* ******* ** the ******** ********.

** ** ********** *** case ** ********, ******** what ** ******** ** that ******** *** * trade-off. **** **** ******** we ******* ** ****** the ***** ******* ******* disclosing ****** ******* ** that *** ******** *** conduct ***** *** **** assessment *** ***** *** patches ********* ** ***** own **** ********* ***** at *** **** **** avoiding ******* ******* ** providing ****** ******* ** that **** *** ***** exploit **** *** *** disclosed *************.

Patch ** *********

*******'* **** ***** *** Service *******/********** ****** ***** required *** **** ******* of ******** ******, *** recommends ******** *********** ** removing ******* ******* ****** to *** ******. ***** that **** ******* ******* are ******** ** ********** multi-site, *****-******** ************, ******** outside ******* ****** ***** essentially ******* *** ********* of ***** *******. ** such, ******** ******** ********* upgrades.

Criticism ** ******* *************

******* *** **** **** vocal ***** ************* ********, specifically ******* *************, **** notably ** ********* ********* / ************ Hikvision *** ****** *******, ****** ******** ***** their ******* ********** ******* and**** ** ******* ***** *********. ******* would ****** ***** ** the **** **** **** disclosed **** **** **** were *** ****** ** do ** ** * sign ** ***** *** trustworthiness.

*******, ***********, ********* *** Huawei ********** **** ***** out *******'* *** ******** vulnerability ** ***** **** any ************ ** ******* likely ** **** ***************.

Poll / ****

Comments (56)

bashis mcw

07/31/18 02:12pm

*********! ****'* *** ** should ** ****!

Undisclosed #5

In reply to bashis mcw | 07/31/18 06:47pm

*********!!

******, ** *** ***** believe **** ** *** way ** ****** ** done, *********** *** **** of *******?

**** *** ** ****** learn, **** **** ******* had **** ********* ******** vulnerability *** ***** **? Surely **’* *** *** first **** **************** ** ******* ***** a **** ** ***** own ********.

** **** ********** **** found ** **** ** feel*********** * *******’* ********, what’s ** **** * company **** **** ******

“** ***** * ******** flaw. ** ***** **. See, ** **** ******** seriously.”

Undisclosed Manufacturer #10

In reply to Undisclosed #5 | 08/01/18 01:04pm

******* ******** ***** ** was ********** ** * third-party *********** ******* *******, not ** ****** ********.

bashis mcw

In reply to Undisclosed #5 | 08/04/18 09:12pm

****, *** ***'* ****** so **** ** **** in-house ***********, ****** **** same ***** *** ***'* get **** *$, ***** either (** ********).

****'* ****** ** ***** seriously ** **** **** actually ********** **** ***** some ******* ***************, *** their ********* ****** ****** to ****** ** *** not "****" ** "******" update - ***** *** really ********* ****!

Undisclosed #5

In reply to bashis mcw | 08/05/18 12:05am

****'* ****** ** ***** seriously ** **** **** actually ********** **** ***** some ******* ***************, *** their ********* ****** ****** to ****** ** *** not "****" ** "******" update...

**, **** ** * reasonable *** ******** ********.

******* *****’* ******** ******, assuming **** *** ********* goal ** ** ******* customer ******* ** *** greatest ******* ******, ***** a **** *********** ********** method ** ******?

*** ********,** *** **** **** *** ** ********** determined **** *** ******* has *** **** ** into *** **** ***, perhaps *** ******* ** patch ***** ****** ** made ***** *** ***** of “********* ****** - MAJOR *** *****” ** opposed ** “******** ****** TO *** ****** **** VULNERABILITY”.

******* *** ****** ** surely * ****** ** those *** ***** **** to *** *** ******* for ***-****.

*** ***** *** ******** fix *** *********** ********, it *** ******* ****** more *** **** **** the **** ****** ** patch **.

**** ******* *************** ***** ******* ****** in ******* *********** *** vulnerability ******.

** *** ***** ****, waiting * ****** ** so ***** *** *** has **** ******** ** announce *** ******** *************, would **** *** ***-***** more **** ** ********* the ******* ****** *** hackers ***** ** ******.

**** *** ********* ** not ******* ***** ** was *** *** ** contain *** ****** *** code ***** **** ** harder ** ******* ********.

********?

Undisclosed #3

In reply to Undisclosed #5 | 08/05/18 03:09am

*** *********** ******* ** key ******* **** ***: notifications. ** ***** *** users ***** ** *** fragility ** * ******* system. ******* ******* *** updates ********** *** ****** view **** *********** *** ability *** * ******** or ****** ********** ** help ******* ** ****** the ******* ** **** vulnerability. ** *** *** just ***** ***** *** figure ****** ***, **** is *** * ****, black *** ***** *** community ****** ******* *** voids.

******* ***** **** *** help *** *** **** your ***** ****. ****** concept.

****** ******* *********** ** also ** ********, ** you *** ********* *^^**** say *********.

***** ** ** ******** here, **** ****** *** enhance **** ************ **** BS ************* ** *** system.

Undisclosed #5

In reply to Undisclosed #3 | 08/05/18 03:54am

******* ******* *** ******* underneath *** ****** **** only *********** *** ******* for * ******** ** coding ********** ** **** rectify ** ****** *** outcome ** **** *************.

****’* *** ****** ********** that ***** ******* *** vulnerability **** ** ******* of *** ******* ***** from *** ******** ***** is ********?

bashis mcw

In reply to Undisclosed #5 | 08/06/18 09:14pm

* ** ******* **** one ***** ** ** months ****** ********** ******** doesn't ******, ** ***** will ***** ** **** and **** ** ********** devices **** *** *** been *******. (**** **** at ************ ** ********* his ********* **** *********)

**** * ** ***** matter ** **** ***, is **** ******* ** admit ***** *** **** security ************* ** ***** products *** **** ** their ******** ******** ***** this, *** * ***'* and *** ****** *** either ****** ******* ******* in ********* ******* **** patching.

******, * ***'* ****** any ******* **** ******* when **** ********** ***** own ********, *** ** very **** ***** **** be ******* ** **** Disclosure **** * ******* and **** ******** ***** 3rd *******.

*****, *** ********** *** built ** ******* ***********,****** ******* (******) **** *** you * ****, *** never (******) ****** ****** area ** **** *** vulnerability.

** *.**$

Undisclosed Integrator #1

07/31/18 02:17pm

* **** *** **** by *******. * ***** it's **** **** ****'** not ***** ********** *** vulnerability ******. *** **** low ***** ******* * blueprint ** *** ** exploit *******? * ***** telling *** ****** **** there ** * *************, a *** *** ****** update ** * **** move.

Undisclosed #2

07/31/18 02:19pm

* ** *** ********* that ******* *** *** disclose ******* ** ** exploit ** ***** ** concept. ***** ****** *** often **** ** *********** as * *** ** prevent *** ******** ******* from ******** *** ***** is "**** ******* ** execute" ** "**** ********* certain ********", *** ******* excuses. ***** ** ******* works ***** ***** ** verify ** ***** ******* are ********, *** ***** for ********** *** ********* complexities ** *** ************ does *** ******* ** tries ** **** *** issue.

** **** **** ******* is ****** ********* *** vulnerability, ******* * *****, and ********** ***** ********/******** are ********. ********* * proof ** ******* ***** only *** ********* ** undue **** ** **** point.

Avatar

Greg Hussey

07/31/18 02:21pm

"***************" *** "***************" *** obviously *** ********* ******, let's *** ******* ****. All ******** *** *** potential *** *************** *** do *** ***** *** organization ** ****** ******** an ********* ****** ** their *******/******** *** ********* will ** *********** *.*. diligent ** *******/****** ***** and ******** **** ***************? When ****** ***** ********* (if **** ** ********* to *** ** ******** in **** ******** *****) one *** **** **** at **** *********** *** history.

Undisclosed #3

07/31/18 02:33pm

* ***'* *** ******* as **** ** * should, **** ****** **** if ***** ***** ********** is ***** ******* ** Windows * ********? *** anyone ***** ** ******* one ***** ***********?

** ***** ****, ** you *** * ******** NAS *** *** **** or ***** ******* ***********, DSM ***** ** ** patched *** * ************* released ********* ** ********'* website.

*****://***.********.***/**-******/*******/********/*****************

Undisclosed End User #4

In reply to Undisclosed #3 | 07/31/18 03:16pm

**** ** *** ******** I *** **** ********* with *** ***** ******** on *** ***, ******** Cloud ****, ** ** May **, ****. * sent * ****** ** this ******* ** *** if ***** *** *** update. * **** *** you **** **** * hear ****.

****'* **** * ***** back **** **:

** *** ***** ******** the *** * *******, the ******* ** **** be **** ***** **** year ** ***** ****. We **** **** * years ** ******* ******* with * ******** *** we *** ********* *** windows ******** ******.

Thibaut Louvet

In reply to Undisclosed #3 | 07/31/18 11:31pm

* ** *** ******** of ****** ******* ******* Group ** *******.

***** *** ******** ***** Link ********* **** ** Windows * ********, ***** are ** ***** *************** that ****** *** *********. We ****** ********* ******* the ******** ** **** field ******* ******* ** frequently ** ********. **** is *** ** **** firmware ******** ****** ** bundling ******* ******** ******* with *** ******** ***** Link ********, **** *** be *********, ********* *** managed ******** **** ******** Center.

**** ******* ** *** concerns ****** *** ***-**** vulnerability, ** ******* ** only ****** **** ******** access ** **** ******** Cloud **** ********** *** they *** ******** ** only **** **** ******** interfaces ** ******** **** risk. ** ********* ********** Synergis ***** **** ** a ****** ******* ****** in * ****** **** of **** ********.

Avatar

Sean Nelson

Nelly Security | 07/31/18 03:47pm

** *********, ******* *** vulnerabilities, **** *** *******. Hikvision **** ******, **** are ******* ** ***** to *** **** *** usa. ******* ******* ** more ******** **** ****.

Michael Miller

In reply to Sean Nelson | 07/31/18 03:52pm

*** ** *** *** see *** ********** ******* how ******* ******* **** compared ** **** ******* Hikvision *** *****?

Undisclosed End User #4

In reply to Michael Miller | 07/31/18 03:58pm

** ****. *** **** to ******** *** ******** is ***** ** *********. He *** ** ** on **** ** ******* counter ***** ** **** in ***** ** **** business *******. **'* **** the ******** *** **** everyone ******** *** **** "Haha ****'* ** ****. Good **' ****."

Avatar

Sean Nelson

Nelly Security | In reply to Michael Miller | 07/31/18 06:45pm

*** **** * *****. With *******, *** *** paying ********* *** ******* per *************. **** *********, you *** **** ****** a *** *******. *** difference.

* ***** ** ***** be * **** **** for ************* ** **** note *** ********* ******** industry ********* *** ***** their *********** **** ******* unless *** **** **** an ********. **** ** u *****?

Undisclosed Integrator #6

In reply to Sean Nelson | 07/31/18 06:54pm

* **** *** *** being ***** *** (******* without ******* **) *** are ***** ** *** money. ** * ****** a ****** *** *** for ** *** ***** and ****'* **** ***** Chinese ***** ****** ****** et **, **** ********* all *** ****, ******** (being **) ***** ***. If * ****** ** represent *** **** ** class ******** *** ** customers *** ******* ** pay *** **** ***** of ******* *** ********* then ** ***** ** with ******* *** * camera ************ **** ****** more ****** ** ******** related ********. **** ******.

Undisclosed #12

In reply to Undisclosed Integrator #6 | 08/02/18 02:53am

** ** ****, * prefer *** ** **** a ****** *** ** dog's ***** ** * think ** *** ***** by ******.

** *** ***, ***** there's * *** ** companies ********* ******* *** components **** ** ***** factories, ** ***** * way ** ***** ***** about ***** ****** ** those *********?

Undisclosed #2

In reply to Sean Nelson | 07/31/18 04:07pm

** *********, ******* *** vulnerabilities, **** *** *******. Hikvision **** ******

**** *** ***** ***** what *** **** ***** for * ******. ******* proactively ***** * ***-**** firm, ********** * *************, patched **, *** ************ this *** ****** *** hacks **** *****. **** did *** **** *** fact **** * ************* was **********.

*********, **** ****** *******, has ******** * ****** of *****, **** ****** devices ***** ********* *** affected. ********* *** ********* only ****** *** ************** about ***** *************** *** hacks **** ****** ** do **, ***** ***** IPVM ********. ********* *** not ** *** *** taken ** ******** **** inspires ********** ** ***** in *** *******.

*** ********* **** ** a ****** **** *******. One ******* ***** *********** to ******* * ************* from ******* **** * hack *** **** *******. Another ******* ***** * head-in-the-sand ****** ******** *** gets ******.

John Honovich

IPVM | In reply to Undisclosed #2 | 07/31/18 04:34pm

******* *********** ***** * pen-test ****, ********** * vulnerability, ******* **, *** communicated **** *** ****** any ***** **** *****.

** **** ** **** if *** ***** **** place. *** *******, ** Hikvision's *****, *** ***, found **** *****, **** would **** ******* **** it *** ** **** as **** ***** *** not **** ******. *** Genetec ****** ********** ********* who **** **** ******** concerns ** ******* ***** to ** ** *** of ***** ******.

**** *****, * ** agree ***** *** ********** in *************. *** **** critical *************** *** ********* found ** ********** ******** products **** **** **** fixed *** *** *********?

Undisclosed #2

In reply to John Honovich | 07/31/18 04:57pm

** **** ** **** if *** ***** **** place.

**** *****. ****** **** to "****** *** ***** of ******** **** ******** publicly".

Undisclosed #3

In reply to Undisclosed #2 | 07/31/18 06:48pm

******* ***** *** **** taken *****. :/

Undisclosed Integrator #1

In reply to Sean Nelson | 07/31/18 04:14pm

* ***** *** ** the **** *********** **, Genetec ********* ** * vulnerability******** *** ******** *********. Also, *** **** **** they ****'* **** **, hide ** ***** ** obscure ******* ** ***** no ************** *** *** vulnerability. * **** *** love *********, *** **** on ****, **** *** have ** ***** **** is *** *** **** should ****** * *************.

Undisclosed Integrator #11

In reply to Sean Nelson | 08/01/18 01:47pm

** *** ********* ***** at *** *** **** deployed ** ***** ************* - **** ***** **** been ********** ******* ***** with *** ** *** other ****** **** - but **** ******'* **** the ****** ** **** would **? **** ***** require ** ********, **** handed ****** **** **** doesn't **** ************* ** the **** ***.

Scott Sheldrake

07/31/18 04:25pm

**'* **** ** *** that ******* ***** *** testers. * ****** ** this ** ******** ******** practise ***** *** *** players, ** ** **** is ********* ******?

John Honovich

IPVM | In reply to Scott Sheldrake | 07/31/18 04:35pm

*****, *** **** ** this ** '********' *** quite * ****** ** video ************ ************* *** doing **** ***. ****'* notable ** **** ******* disclosed *********. ** ** mention ** *** ****, often ************* **** ***** vulnerabilities ******* ***** *** never ******** *********.

Scott Sheldrake

In reply to John Honovich | 07/31/18 05:10pm

* ***'* **** *** Genetec's ******* ********* *****, but **** ** **** a *** ** ***** (and ***** **** **** some ***** **** ** v6.0 *** *.*) ** costs ***** ** *******. So ******* *** ** looking ** **** ** a ****** ****** *** spinning ** ** * "look ** **, ** take *** **** ****" scenario.

*'* *** * **** fan ** ******* ** they *** * ****** dealer-only ******. ******* *** HIK *** *****'* *****, at ***** **** ***'* discriminate ******* ******* *** medium ***** *********. (** - **** ******* *** can't **** *** *** boys ****). *** *'* be ******* ** *** Genetec *** * ******** more **** **** **** admit **, *** ***** 1% ** *** ****** uses ***** ******** ****** cares.

******** ******* *********.

Avatar

Sean Patton

IPVM | In reply to Scott Sheldrake | 07/31/18 05:36pm

*****,

***** ******* ** ******** Center *** **** ******* with * ********** ******, which ** ********* *** free *** ******** ******* a ******** ******, **** if *** ****** ** no ****** ******* ** a ******* ********* **** (software *********** *********).

Undisclosed Integrator #8

In reply to Scott Sheldrake | 08/01/18 07:42am

** *****,

******** ** * *** and * ******* *******, the '****** ****** **** system' (******* *******) ***** us ******* ******* *** investing ** *** ******** and ************* ******** **** dealing **** ********** *******.

*******'* ******* ** *** partner **** ******* *** product, ******** *** ** as ******** *** **** at * ******* *** more *********** * ***** point.

** ** *** ********* running ***** ******* *** installing ******* ********, *** don't ***** *** ***** point *** ******* ** install ***** *******? ** thanks. *'* ****** ***** the ****-**-***-****** ******* ****** installers *** ** *** equation.

$ *****, ******* **** after ***** ********. ** have **** ********* ****** our *** ** *******. How **** ***** ************* do *** **** **** do ****. * ***'* recall ********* **** ******* us *** ****** '**'** got * ***** ******* for *** ****, ****'* the ****** ** *** client ***...'

** ****** ** ******* bugs *** ***************, **'* all **** ******** ***** all. **'* *** **** respond ** ***** ****** that ******. *****'* ** charge *** ********** *****. If *** **** *** SMA *******, ***** ** reasonably ****** *** *** free ******** *** *** the ********. **** ** exactly *** **** ** Exacq.

** *** ***, ** you **** ** ******* the ********** ******** **** Exacq, ***'** **** ** join ***** '*** **** club' ***.

Undisclosed Integrator #9

In reply to Undisclosed Integrator #8 | 08/01/18 08:08am

*** ******** **** * closed ****** **** ****** like ******* ** ** maintain ******* ** ************* is ******** ********.

****** **** ******** (********, Genetec, ******* ******) *** there ** ****** *** number ** ******* ** hard-spec'd ******* *** ******** profit ******* ** *******. Period.

** ********, ******* *** were ***** ********* **** quality ** ******** **** they ***** ****** ******* extensive *** ********* ******** to ****** * ******. Instead, **** ****** ** lock *** ****** ***** companies ** *** *** keep *** *** **** fat ***** *** ******* guys (** ******) ******.

******* ** *** ******* for ***** ****** **** a *** ***. ****'** a ****** ******-**** ******* that **** ***** *** top *% ** ********** customers *** *** ******** through *********. **'* **** saying **** ******* ***** gets *** *******. ** that ******* ***** ******* magic *********** ****, ** the **** **** ******* owns **% ** *** desktop ****** *** ** the ****** ******.

Undisclosed Integrator #13

In reply to Undisclosed Integrator #9 | 09/14/18 01:20pm

** *** *** ** those ****** ***** *********, who ******* **** ******** with *** "*** *** boys".

** ** *** ******. We **** * **** high *** *** *** quality ** *** ******** system *************, ***** ** why ******* *** ****** you ********* **** ** on ***** ***** **** as ******* *** ***** top ***** ******* *********.

*******, *** *** ****** you ********* ** ******** in ***** ******* **** of *********** *** ********* pretty **** *** *** nationals, ***** ** ******, but **** **** ****** have ** ***** ****** of ******* "******" ***** businesses *** **** ******** in ***** ******** *** make ** ****** ****** to ******* ***** ******** and ******* ***** ******* using *** ******* ********* of *** ********.

******* *******. ********* **** dealers *** ********* **** products *** ************ **** products ******** **** *******.

Michael Miller

In reply to Undisclosed Integrator #9 | 09/14/18 01:41pm

** ********, ******* *** were ***** ********* **** quality ** ******** **** they ***** ****** ******* extensive *** ********* ******** to ****** * ******.

******* **** ******* ********* and ********* ******** ** become * ******.

******** **** *** ****** for ********.

****** * ****** ******* that **** *********** ****** coming ** * ****** are *********. * **** seen **** ******** ********* care **** ***** ***** than ********** * ******* solution ** *********.

****** **** ******** (********, Genetec, ******* ******) *** there ** ****** *** number ** ******* ** hard-spec'd ******* *** ******** profit ******* ** *******. Period.

**** * ****** ** Avigilon ****** * *** 2 ****** ** *****. Now * **** ** people *** ******* *******. I **** **** **** other ***** *-* *** shops **** *** **** successful ******* ********.

Avatar

Ricardo Souza

IndigoVision Ltd | IPVMU Certified | 07/31/18 05:04pm

**********, ***** *** *******.

Scott Sheldrake

07/31/18 05:11pm

* ***'* **** *** Genetec's ******* ********* *****, but **** ** **** a *** ** ***** (and ***** **** **** some ***** **** ** v6.0 *** *.*) ** costs ***** ** *******. So ******* *** ** looking ** **** ** a ****** ****** *** spinning ** ** * "look ** **, ** take *** **** ****" scenario.

*'* *** * **** fan ** ******* ** they *** * ****** dealer-only ******. ******* *** HIK *** *****'* *****, at ***** **** ***'* discriminate ******* ******* *** medium ***** *********. (** - **** ******* *** can't **** *** *** boys ****). *** *'* be ******* ** *** Genetec *** * ******** more **** **** **** admit **, *** ***** 1% ** *** ****** uses ***** ******** ****** cares.

******** ******* *********.

Avatar

Sean Patton

IPVM | In reply to Scott Sheldrake | 07/31/18 05:37pm

*****,

**** ******* ** ******** Center *** **** ******* with * ********** ******, which ** ********* *** free *** ******** ******* a ******** ******, **** if *** ****** ** no ****** ******* ** a ******* ********* **** (software *********** *********).

Christopher Ritter

In reply to Scott Sheldrake | 07/31/18 09:21pm

*****, * ** *** Northeast ******** ** ***** for ******* *** * am *** ******** ** post ** **** *** I ***** * *** get **** **** **** one. **** ******* ** completely ******, ** **** tons ** ******* ** medium ***** ********* ** partners, ******** **** **** we **** ****** ****. We **** ******** ********* in *** *****/************ *** On-prem ********* ** *** any **** ********** ** end-user *** **** ** a ****** ************* ** our ********. ****** ***** out ** ****** ** your ***** *** *** we ***** ** **** than ***** ** ******* a *********** **** *******. We ***** ***** ************ and ** *** ***** on *****!

Scott Sheldrake

In reply to Christopher Ritter | 08/01/18 04:52am

*** *****,

*** *** ** ******* in ** ****** ** become *** ** **** Genetec? **'** *** **** tenders ***** ******* ***** have ***** ** * lot ** ******* ****** with ******* *** *****. Is ***** ** *** here? ***** ***?

******

Avatar

Clint Hays

Intelligent Security Systems - ISS | 07/31/18 06:40pm

****** ** *******. ** software, ** *****, ** flawless. ***** **** *****'* an ***** **** ****** than ******** ** ** a ****** *** ****** it.

Undisclosed Manufacturer #7

07/31/18 07:08pm

** * "**********" ** Genetec, *'** *** **** this ** ********** *** correct ********. *************** *** to ** ********, ** what *** ****** ********* might *** ** ********. A ********* (*** ******) methodology ** ********** ***** types ** ****** **** always ******* * ****** level ** ********** **** your ******** ****.

Peter Pavlov

07/31/18 09:34pm

* ****** ****** ** be ***** ** * vulnerability *** *** ** address **. ** *** manufacturer ******* ********* ** and **** ******** *** fix ** *** **** release, **** ***** **** the **** *** ***-***** to **** ** ****** they **** *** ********(***** they ***'* **** ** will *** * ***** vulnerability) *** ****** **** to ** ******. ** noted ** *** ******** comments *** *** ** also ******** *** ******* with ******* *** *** clearly ***** ******* ** not ****** ** ******** the *****. ** ***** cases, *** ***** *** in *** **** ******* will *** ******* *** issue ******.

Avatar

Jon Dillabaugh

Pro Focus LLC | 07/31/18 09:59pm

**** ***** **** ******* Hikvision, *** ****** **** and ***.

Undisclosed #2

In reply to Jon Dillabaugh | 07/31/18 10:33pm

******** ******'* **** ******** if ********* *** ******* any *** ** ***** numerous ****** ********* *************** in ** *************** * manner.

Avatar

Jon Dillabaugh

Pro Focus LLC | In reply to Undisclosed #2 | 07/31/18 10:42pm

***** *****. **** ** like ******* * ****** code ****** *** ********** authorities ** ******* *** source **** **** ** their ********? **** ****’* receive **** *******, *** it.

********, ***** ***’* **** Hikvision ***** ** ** endear **** ******* ****** here. **** *** **** man ******* ** ****** what.

Undisclosed #2

In reply to Jon Dillabaugh | 07/31/18 10:50pm

**** ****’* ******* **** acclaim, *** **.

**, ** ****'* ******* it *** * ******** PR ****, *** ** authentic *******. ***, ** Hikvision *** **** ******* and ************ ***** ***** numerous *************** **** ******** wouldn't **** ****** ** dangle *** *** ******** "source **** ******" ** try *** ****** ********* and *********.

Undisclosed Integrator #11

In reply to Jon Dillabaugh | 09/14/18 02:10pm

******* *** - ***'** be ******* "**-*********" *** have *** ***** ** Trump ******* **** *** by *** **** ********.

Edward Knoch

08/01/18 04:50am

* ***** **** **** admission ***** **** **** truly ** **** ***** their ********** *** **** to ****** *** ********** of ***** ********* **** privacy. ****** **** ******* that *********, ******, ********* and ******** **** ***** vulnerabilities ** **** **** can *** **** *****.

***** *** * **** that ********** ****'* **** a ******* - ** enhanced *** ***** ** the ****. ******* ** lambasting *******, ** ****** be ********** **** ** their ************ - * don't **** **** *** product.

**** *** ** *** Genetec.

Avatar

Joseph Marotta

IPVMU Certified | 11/10/18 07:02pm

** ***** *** **** to *** **** **** Score ********** ***'* *******. Is ** **** **?

John Honovich

IPVM | In reply to Joseph Marotta | 11/11/18 01:51pm

******, *** **** ******** (*****://***.*****.***/****/**********/*.*) **** **** *** me.

Avatar

Sean Patton

IPVM | 07/10/19 06:16pm

******* ****-********* ******* *************, related ** * ********* blank ******** **** ** a ******* ***** *******:***** ******* *************. ** ** ****** a **** **.* **** score ** *.* (****) because **** *** ** used ** **** ************ access ** *** ******'* live ** ****** *****.

***** **** ****** *************, Genetec **** ****:

*** ************* *** ***** in ** ***** ******* of ******** ****** *.* prior ** *** ******* by *** ********** ** hired. ***** *** ******* user **** *** *** Media ******* ** *** same ******* **** ******* in ******** ****** **** installation (*** *** ***** user) ** *** ******** that *** ********* ******** change ** *** ********* Assistant **** ***** ********** in *** ****** **** would **** ****** *** password ** *** ***** Gateway. **** ********** *** false *** ** *** root ***** ** *** issue.

*** ***** ******* ** not * **** ******* by ******* ** ******** Center. * **** ******** creating ***** ******* **** and ********* *** ***** detailed ** *** ************* Guide ******’* **** *** any ***** (** *** however ******** *** ********* guide **** ** ** sure). *** **** ******* arises **** * **** creates * *** ****** role, ** **** ************* also ******* * ***** Gateway **** **** *** user *** *** ** aware **** */** *******. We ***’* ****** ***** to ** ***** ** this, *** **** ** reason *** ** ******** was *********.

*********, *** ***** **** scenario *** ******* ** the ************ *** ** is *** **** ** exploit: *** ****** ***** has ** ******** *** unique *********** ****** (****** Guid) *** **** ****** they ***** ** ****** via *** **** *********.

*** ******* **** ** a ***** ** *********** numbers **** ***** ******** the *** ******* ** the ****** (** **** example ** **** ******'* GUID):

Undisclosed #5

In reply to Sean Patton | 07/10/19 11:08pm

*** ************* *** ***** in ** ***** ******* of ******** ****** *.******** *** ******* ** the ********** ** *****.

******* **’* *******? *** it ******** ******?

** ***** ********, *** was ****** **********?

Avatar

Sean Patton

IPVM | In reply to Undisclosed #5 | 07/11/19 03:45am

*** ************* ** *** present ** *** ******** in *.*, ** *** found ****** *.* ***-******* during *********** *** ** present ** *.* *** 5.7 (** ** ***) if ***** *** *** Client ******. ******* *******/**/*********** missed *** ************* *** 2+ *****.

**** ** *** ****** of ******** ********:

Undisclosed #5

In reply to Sean Patton | 07/11/19 02:57am

...** ** *** **** to *******: *** ****** still *** ** ******** the ****** *********** ****** (called ****) *** **** camera **** ***** ** access...

**** *** ********, *** easy. **** *** ***, easy.

Undisclosed Manufacturer #14

In reply to Undisclosed #5 | 07/11/19 12:58pm

"**** *** ********, *** easy. **** *** ***, easy."

** *** **** * hacker ** **** *** you **** ****** ****** no?

Undisclosed #3

07/10/19 06:24pm

*** **** **** **** told ** ********** ** advising *** ********* *** vulnerability ******* * ***** like ** **** *** thing. *** *** ***** for ****? ****** **** creating *** **** ************* initiates *** ******** ** the ***** ******* **** (RDP **** *****, ***).

******! ***'** *****!

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on VMS

Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
Avigilon ACC7 VMS Tested on Jul 22, 2019
Avigilon's Control Center 7 boldly claims it will "transform live video monitoring" with the new Focus of Attention "AI-enabled" interface. We...
History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to emerging into an AI cloud era.  The goal of this history...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Axis ARTPEC-7 P1375-E Camera Tested on Jul 12, 2019
Axis claims the new P1375-E box camera with ARTPEC-7 chip delivers "clear, sharp images in any lighting condition." But how well does it do? We...
Network Optix / Hanwha Cloud Access Tested on Jul 02, 2019
Remote cloud access is becoming a bigger differentiator, as cybersecurity issues underscore the problems of port forwarding and many integrators...
FLIR Saros Visible / Thermal Analytic Camera Tested on Jun 26, 2019
FLIR's Saros claims "accurate, actionable alerts" with a combination of 1080p visible and dual thermal sensors along with IR and white light...
Axis Live Privacy Shield Analytics Tested on Jun 25, 2019
Privacy is becoming a bigger factor in video surveillance, driven both by increased public awareness and by GDPR. Now, Axis has released Live...
Directory of 60 Video Surveillance Startups on Jun 25, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...
Genetec Beats Milestone For IHS #1 on Jun 21, 2019
For years, Milestone has touted that they are the #1 VMS. Now, Genetec has beaten them in IHS rankings. But what is this? Even other manufacturers...

Most Recent Industry Reports

How To Quickly Assess An Unknown Company on Jul 23, 2019
There are hundreds of companies in the physical security markets, ranging from a flood of new startups to small companies that may or may not be...
Bosch Starlight 8000i Cameras Tested on Jul 23, 2019
Bosch has released their new Flexidome IP Starlight 8000i cameras, claiming "exceptional detail even in extreme low-light situations." To see...
Responsibility Split Selecting Locks - Statistics on Jul 22, 2019
A heated access debate surrounds who should pick and install the locks. While responsible for selecting the control systems, integrators often...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
Avigilon ACC7 VMS Tested on Jul 22, 2019
Avigilon's Control Center 7 boldly claims it will "transform live video monitoring" with the new Focus of Attention "AI-enabled" interface. We...
History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to emerging into an AI cloud era.  The goal of this history...
Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
New GDPR Guidelines for Video Surveillance Examined on Jul 18, 2019
The highest-level EU data protection authority has issued a new series of provisional video surveillance guidelines. While GDPR has been in...
Wyze AI Analytics Tested - Beats Axis and Hikvision on Jul 17, 2019
$20 camera disruptor Wyze has released free person detection deep learning analytics to all of their users, claiming users will "Only get notified...
Anyvision Aims For 2022 Revenue of $1 Billion on Jul 17, 2019
Only 3 video surveillance manufacturers do a billion dollars or more in annual revenue - Hikvision, Dahua, and Axis. Now, Anyvision plans to join...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact