Vulnerability · Published Jul 16, 2021 · Assigned by twcert
CVE-2021-35961TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Use of Hard-coded Credentials
Critical 9.8
In plain English
A critical-severity hard-coded credentials in Door Access Control and Personnel Attendance Management system from TAIWAN SECOM CO., LTD.,. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.2%top 17.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TAIWAN SECOM CO., LTD., | Door Access Control and Personnel Attendance Management system | unspecified – through 3.4.0.0.3.12_20210525 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-4905-c99ac-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/2e4e69d5-2e32-4f73-ac7e-a66432e020e4 x_refsource_MISC