The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory, ICSA-25-308-02, for a critical vulnerability in Survision’s License Plate Recognition (LPR) Camera system.
The vulnerability, identified as CVE-2025-12108, is a “Missing Authentication for Critical Function” (CWE-306) and has been assigned a CVSS v3.1 base score of 9.8 (Critical). CISA warns the flaw is “remotely exploitable” with “low attack complexity.”
The issue affects all versions of the Survision LPR Camera deployed in the commercial facilities sector.
The flaw represents a catastrophic failure of “secure-by-default” design principles. According to CISA and GitHub’s Advisory Database, the “Survision LPR Camera system does not enforce password protection by default.” This allows an unauthenticated attacker remote access to the configuration wizard “immediately without a login prompt or credentials check.”
Successful exploitation “could allow an attacker to fully access the system without requiring authentication.” An attacker could view all camera data, delete or alter security logs, add their own license plates to an “approved” list to bypass physical security, or use the compromised camera as a pivot point to attack the internal corporate network.
The mitigation provided by Survision confirms the systemic nature of the flaw. The company has released Firmware version v3.5, but merely applying the patch is insufficient. Users must also manually “enable the configuration password authentication” and define user roles with minimal rights—steps that should have been mandatory at first boot. For users with versions older than 3.5, Survision recommends manually activating the “lock” password in the security parameters.
Sources: CISA, Industrial Cyber, SecurityOnline
—
By the ID Tech Editorial Team
