CVE-2020-3931

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
GeoVision	Door Access Control Device	>= GV-AS210, <= 2.21; >= GV-AS410, <= 2.21; >= GV-AS810, <= 2.21; >= GV-GF192x, <= 1.10; >= GV-AS1010, <= 1.32

References

https://www.acronis.com/en-us/blog/posts/backdoor-wide-open-critical-vulnerabilities-uncovered-geovisionThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-3754-b77d0-1.htmlThird Party Advisory
https://www.acronis.com/en-us/blog/posts/backdoor-wide-open-critical-vulnerabilities-uncovered-geovisionThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-3754-b77d0-1.htmlThird Party Advisory

Timeline

Published: Jul 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39327.5A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.CVE-2020-39335.3TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user accoun CVE-2020-39349.8TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection CVE-2020-39357.5TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cook CVE-2020-39369.8UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject CVE-2020-39377.5SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary CVE-2020-39387.5SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into ne CVE-2020-39396.1SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked t CVE-2020-39405.9VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.CVE-2020-39417.0The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine CVE-2020-39439.8vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configu CVE-2020-39448.6vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to