(November 7, 2025)
A notification has been issued by VINCE (Vulnerability Information and Coordination Environment) in the United States, and relayed in France by the administration, concerning the vulnerability of SURVISION LPR cameras that are freely accessible on the Internet and allow third parties to connect to them to change their settings. The reported vulnerability therefore concerns SURVISION LPR cameras, exposed via a public IP from the Internet, and whose configuration protection has not been activated via the activation of password authentication set up in 2018 by SURVISION.
To date, no known public exploitation of this flaw has been reported. However, following this notification, SURVISION reminds its customers of the best practices to apply for the operation of LPR cameras on the network, as well as any computer equipment:
- Minimize network exposure of equipment by ensuring that it is not accessible from the Internet.
- Protect devices behind firewalls and isolate them from office networks.
- When remote access is required, use secure methods, such as virtual private networks (VPNs).
- Enable the configuration lock password available as standard.
In addition to these provisions, the local regulatory context concerning personal data (GDPR in Europe) must also be taken into account.
"IT security and data protection are a priority for SURVISION; our equipment implements the most demanding practices and protocols in this area, and our technical support teams are available to guide customers in the process of securing their equipment."
Jérôme Douret, CTO of Survision.
For detailed instructions or assistance, please contact: support@survisiongroup.com