CISA Warns: Critical Survision LPR Camera Flaw (CVE-2025-12108, CVSS 9.8) Allows Unauthenticated Takeover

CISA warns of a critical vulnerability in all Survision License Plate Recognition cameras (CVE-2025-12108, CVSS 9.8) that could allow unauthenticated takeover of affected systems. According to CISA’s advisory, successful exploitation could let an attacker fully access the system without authentication, due to a lack of password enforcement in Survision’s configuration wizard.

The flaw stems from incomplete authentication for critical functions (CWE-306), with all Survision LPR cameras affected regardless of model or firmware generation. Survision has released firmware version v3.5 introducing login/password authentication for configuration access, and administrators are advised to define users with minimal privileges and, where feasible, enforce client certificate authentication.

For installations not yet upgradable, CISA recommends enabling the lock password in security settings and using client certificates where possible on older firmware.