This vulnerability (CWE-532) involves the insertion of sensitive information, specifically Server Admin credentials, into log files on Genetec Security Center main servers. An attacker with local operating system privileges could leverage this to gain unauthorized access to administrative credentials. The issue was discovered by a third party engaged by Genetec. The vulnerability is tied to certain installation package builds rather than solely to product version numbers, complicating exposure assessment. Affected versions span from 5.7 SR6 through 5.13.3.0, but only installations using vulnerable builds are impacted. Remediated builds can be identified by verified installation package hashes. The CVSS v3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

If exploited, an attacker with local OS access to the main server could obtain Server Admin credentials, potentially leading to full administrative control over the Genetec Security Center environment. This compromises confidentiality, integrity, and availability of the system. However, there is currently no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is tied to specific installation package builds rather than version numbers alone, organizations should verify their installation package hashes against the vendor's list of fixed builds. Until an official fix or update is provided, restrict local OS access to trusted personnel only to reduce risk. Monitor Genetec's security advisories for updates on remediation.