CVE-2019-12392
📋 TL;DR
Anviz access control devices allow unauthenticated remote attackers to execute arbitrary commands without requiring a password. This affects organizations using Anviz access control systems for physical security, potentially allowing attackers to manipulate door locks, user credentials, and device configurations.
💻 Affected Systems
- Anviz access control devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain complete control over physical access systems, unlock all doors, add/remove users, disable security features, and potentially pivot to internal networks.
Likely Case
Unauthorized individuals gain physical access to restricted areas by manipulating door locks or creating backdoor user accounts.
If Mitigated
Impact limited to isolated network segments with proper segmentation and monitoring detecting unauthorized command attempts.
🎯 Exploit Status
Public exploit code and detailed analysis available. Attack requires network access to device management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released in 2019
Vendor Advisory: https://www.anviz.com (specific advisory may require vendor contact)
Restart Required: Yes
Instructions:
1. Contact Anviz for latest firmware. 2. Backup device configuration. 3. Apply firmware update via management interface. 4. Verify authentication is required for all commands.
🔧 Temporary Workarounds
Network segmentation
allIsolate Anviz devices on separate VLAN with strict firewall rules
Access control lists
allRestrict management interface access to authorized IP addresses only
🧯 If You Can't Patch
- Disconnect devices from network and use local management only
- Implement physical security monitoring to detect unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to send unauthenticated commands to device management port (default TCP 5010) and check if commands execute without credentials.Check Version:
Check firmware version via device management interface or physical displayVerify Fix Applied:
Verify authentication is required for all management commands and test with invalid credentials.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated command attempts in device logs
- Unexpected configuration changes
- Multiple failed authentication attempts followed by successful commands
Network Indicators:
- Unencrypted command traffic to port 5010 without authentication headers
- Commands from unexpected source IPs
SIEM Query:
source_port:5010 AND (NOT auth_success:true) AND command:*