CVE-2023-38029

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:::::::*
	cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:::::::*
	cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:::::::*
	cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:::::::*
	cpe:2.3:o:saho:adm-100_firmware:q20100602:::::::*
	cpe:2.3:o:saho:adm-100_firmware:t190:::::::*
	cpe:2.3:o:saho:adm-100_firmware:t17041702:::::::*
	cpe:2.3:o:saho:adm-100_firmware:t18051803:::::::*

cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:saho:adm-100fp_firmware:q20100602:::::::*
	cpe:2.3:o:saho:adm-100fp_firmware:t190:::::::*
	cpe:2.3:o:saho:adm-100fp_firmware:t17041702:::::::*
	cpe:2.3:o:saho:adm-100fp_firmware:t18051803:::::::*

cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-28 06:15

Updated : 2023-08-29 23:46

NVD link : CVE-2023-38029

Mitre link : CVE-2023-38029

CVE.ORG link : CVE-2023-38029

JSON object : View

Products Affected

saho

adm-100fp_firmware
adm-100_firmware
adm-100fp
adm-100

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2023-38029", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-08-28T06:15:07.857", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "\nSaho\u2019s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.\n\n"}], "lastModified": "2023-08-29T23:46:48.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51D8D874-7C51-41E7-9689-E795DE1360D3"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50C72BE7-0E40-4F1A-86D6-15E8C78121C8"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EB5DA1F-3BED-4F23-9FA1-C65F6C59235B"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE08CF54-2259-40AF-B68C-F3498133F490"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:q20100602:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28AF1652-9D3F-45F6-969D-FA0D7F688F12"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t190:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "825B2F91-8AC9-4543-9BD8-26760B5F6587"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t17041702:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "176C1D07-D975-4CF8-B54C-16366DF1C848"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t18051803:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA65B75F-139F-4BC6-A5AB-EA74FFE5966A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AA638ECA-B29C-415D-99E7-217D16473C37"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:q20100602:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6612C85-1259-4435-BEB1-DC5ADC8D620D"}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t190:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC7D1DBE-4976-47A4-951B-39B5C9B8736A"}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t17041702:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9487774-CE30-4C04-B296-70B3A73225C7"}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t18051803:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0E10BD2-D64F-49F9-8409-A56AC2E0FD57"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "295DF46C-15E0-47A3-8F21-A48F670C0496"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "twcert@cert.org.tw"}