7.5

CVE-2023-38030

Saho ADM100&ADM-100FP - Execute Code

Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saho ≫ Adm-100 Firmware Version 0.0.4.0
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.3
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.6
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.8
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version q20100602
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t190
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t17041702
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t18051803
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100fp Firmware Version q20100602
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t190
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t17041702
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t18051803
   Saho ≫ Adm-100fp Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.62% 0.449
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cert TW 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.twcert.org.tw/tw/cp-132-7337-501df-1.html
Third Party Advisory