Information Disclosure in BVMS Versions 4.5 to 12.3

Executive Summary

CVE-2026-10764 is a critical information disclosure vulnerability in IQSIGHT BVMS and DIVAR IP products. It involves hard-coded cryptographic keys (CWE-321) that allow man-in-the-middle attackers to intercept or manipulate sensitive data transmitted over secure channels, potentially leading to unauthorized access to confidential information.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for outdated BVMS versions (4.5-12.3) or DIVAR IP firmware (up to 12.3/12.0.1) and verifying if the 'BVMS_SecurityUpdate_01' patch is installed. Inspect network traffic for unusual man-in-the-middle activity or unencrypted sensitive data transmission.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow attackers to bypass security measures and gain access to sensitive communications. It could lead to unauthorized access to confidential information, posing risks to data privacy and security for users of affected BVMS and DIVAR IP systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, fines, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

• Install the 'BVMS_SecurityUpdate_01' tool on all affected systems including BVMS servers, clients, and DIVAR IP devices.
• Apply all Microsoft patches and updates to the system.
• For BVMS 12.2 with OIDC enabled, install the cumulative patch 'BVMS1220296_Patch_Cum11.zip'.
• Ensure .NET Framework 4.8 is installed before applying updates.
• Restart BVMS services or the entire machine after installing updates.
• Upgrade to BVMS version 13.0 or higher for a permanent solution.

Useful 0 Not Useful 0