Critical authentication flaw reported in Survision license plate recognition cameras
Take action: If you use Survision License Plate Recognition (LPR) cameras, first make sure they are isolated from the internet. Then update ASAP to firmware version 3.5, since the cameras are by default open to unauthorized access without any password. Until you update, contact the vendor for instructions to enable the "lock" password feature in security parameters.
Learn More
CISA is reporting a critical security vulnerability affecting Survision License Plate Recognition (LPR) cameras that allows attackers to gain complete unauthorized access to the camera systems without authentication.
The flaw is tracked as CVE-2025-12108 (CVSS score 9.8), is a security oversight in the system's default configuration. The Survision LPR Camera system does not enforce password protection by default, allowing immediate access to the configuration wizard without any login prompt or credentials check. The potential impact includes unauthorized modification of camera configurations, tampering with license plate recognition settings and databases, manipulation of access control lists that determine which vehicles are granted entry, disruption of parking or tolling operations leading to revenue loss, theft of sensitive vehicle movement data and personal information, and deployment of the compromised systems as pivot points for broader network attacks on facility infrastructure.
Affected versions are all versions of the License Plate Recognition LPR Camera prior to firmware version 3.5.
Survision strongly recommends that all users immediately update to firmware version 3.5 or later. For organizations running the updated firmware, Survision recommends enabling configuration password authentication by defining users and roles with minimal rights in the user management system, and where possible, enforcing client certificate authentication for additional security layers.
For organizations still operating on previous versions (prior to v3.5) who can't immediately upgrade, Survision recommends activating the "lock" password feature in the security parameters as an interim measure, and where possible, enforcing client certificate authentication. Organizations should contact Survision directly for detailed guidance on implementing these temporary protections.
As usual, these systems should be isolated from the internet and accessible from only from trusted networks.
