Vulnerability · Published Jul 16, 2021 · Assigned by twcert
CVE-2021-35962TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Path Traversal
High 7.5
In plain English
A high-severity path traversal in Door Access Control and Personnel Attendance Management system from TAIWAN SECOM CO., LTD.,. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.8%top 21.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TAIWAN SECOM CO., LTD., | Door Access Control and Personnel Attendance Management system | unspecified – through 3.3.2 |
| TAIWAN SECOM CO., LTD., | Door Access Control and Personnel Attendance Management system | unspecified – through 3.4.0.0.3.12_20210525 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054 x_refsource_MISC