9.1

CVE-2023-38028

Saho ADM100&ADM-100FP - Broken Access Control

Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data,  but can’t control system or disrupt service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saho ≫ Adm-100 Firmware Version 0.0.4.0
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.3
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.6
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.8
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version q20100602
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t190
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t17041702
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t18051803
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100fp Firmware Version q20100602
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t190
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t17041702
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t18051803
   Saho ≫ Adm-100fp Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.67% 0.47
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cert TW 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html
Third Party Advisory