by Kastro
Paper/Archive/CVE-2023-38028

CVE-2023-38028

Saho ADM100 — Saho ADM100&ADM-100FP - Broken Access Control

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.2.592 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.

Affected

ProductAffectedFixed inSource
ADM1000.0.4.0–CNA
ADM1000.0.4.3–CNA
ADM1000.0.4.6–CNA
ADM1000.0.4.8–CNA
ADM100Q20100602–CNA
ADM100T17041702–CNA
ADM100T18051803–CNA
ADM100T190–CNA
ADM-100FPQ20100602–CNA
ADM-100FPT17041702–CNA
ADM-100FPT18051803–CNA
ADM-100FPT190–CNA

Scores by source

twcert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftwcert.org.tw/tw/cp-132-7335-d300a-1.html