CVE-2025-12491

Executive Summary

CVE-2025-12491 is an information disclosure vulnerability in Senstar Symphony, a physical security and video management platform. The flaw resides in the FetchStoredLicense method, which exposes sensitive information—including stored credentials—to unauthenticated remote attackers. With a CVSS score of 7.5 (High), this vulnerability can be exploited without authentication, potentially leading to full compromise of the Senstar Symphony installation. No patch is currently available, and no public proof-of-concept (PoC) code has been released. The vulnerability was reported via ZDI-CAN-26908.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact and lack of required authentication make this a critical risk for any organization using Senstar Symphony. An attacker can silently extract stored credentials, enabling lateral movement or deeper compromise.

Deep Dive & Mechanics

The vulnerability exists in the FetchStoredLicense method of Senstar Symphony. This method is designed to retrieve license information, but due to improper access controls or input validation, it exposes sensitive data—specifically stored credentials—to any unauthenticated remote caller. The exact mechanism likely involves an API endpoint that does not enforce authentication or authorization checks before returning license-related data, which includes embedded credentials.

The exposure of credentials can allow an attacker to:

• Access other parts of the Senstar Symphony system.
• Potentially pivot to connected systems (e.g., cameras, access control).
• Escalate privileges within the environment.

Since no patch is available, the vulnerability remains exploitable in all current versions.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def FetchStoredLicense(request):
    # No authentication check
    license_data = get_license_data()
    return license_data  # Contains credentials

A patched version would require:

# Patched pseudo-code
def FetchStoredLicense(request):
    if not is_authenticated(request):
        return "Unauthorized"
    license_data = get_license_data()
    # Sanitize sensitive fields
    license_data.pop('credentials', None)
    return license_data

Exploitation & Lab Setup

Red Team

Since no public exploit code exists, a red team would need to craft a custom exploit. The attack flow:

1. Reconnaissance: Identify Senstar Symphony instances via Shodan or network scanning (e.g., port 80/443, custom ports).
2. Endpoint Discovery: Probe for the FetchStoredLicense endpoint (likely /api/FetchStoredLicense or similar).
3. Exploitation: Send a direct HTTP GET or POST request to the endpoint without authentication.
4. Data Extraction: Parse the response for credentials (e.g., plaintext passwords, API keys).

Example curl command:

curl -X GET http://target:port/api/FetchStoredLicense

If successful, the response will contain sensitive data.

Blue Team

To detect exploitation attempts:

• Monitor for unusual access to API endpoints, especially FetchStoredLicense.
• Look for requests without authentication tokens or session cookies.
• Alert on responses containing patterns like password, credential, or secret.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/FetchStoredLicense from untrusted IPs.
• Logs: Access logs showing 200 responses to unauthenticated requests to the endpoint.
• Data: Exfiltration of license data containing credentials (e.g., "password":"...").

Detection Engineering

YARA Rule

rule CVE_2025_12491_Senstar_Symphony_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12491 in Senstar Symphony"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12491"
    strings:
        $endpoint = "FetchStoredLicense" ascii wide nocase
        $credential = "password" ascii wide nocase
        $credential2 = "credential" ascii wide nocase
    condition:
        $endpoint and ($credential or $credential2)
}

Sigma Rule

title: CVE-2025-12491 Senstar Symphony Information Disclosure
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated access to FetchStoredLicense endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/FetchStoredLicense'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate internal monitoring
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12491 Senstar Symphony FetchStoredLicense Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/FetchStoredLicense"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Since no patch is available, immediate mitigations include:

1. Network Segmentation: Restrict access to Senstar Symphony to trusted IPs only.
2. Web Application Firewall (WAF): Block requests to /api/FetchStoredLicense from untrusted sources.
3. Authentication Enforcement: If possible, implement a reverse proxy that requires authentication before forwarding requests to the vulnerable endpoint.
4. Monitor Logs: Actively monitor for exploitation attempts using the provided detection rules.
5. Vendor Contact: Reach out to Senstar for an ETA on a patch.

Valters IT
Securing Digital Frontiers