CVE-2023-38028

{"id": "CVE-2023-38028", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-08-28T05:15:07.667", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "\nSaho\u2019s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can\u2019t control system or disrupt service.\n\n"}, {"lang": "es", "value": "Los dispositivos de asistencia ADM100 y ADM-100FP de Saho tienen una autenticaci\u00f3n insuficiente. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad para saltarse la autenticaci\u00f3n y leer la informaci\u00f3n del sistema y operar con los datos del usuario, pero no puede controlar el sistema ni interrumpir el servicio. "}], "lastModified": "2023-08-29T23:47:08.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51D8D874-7C51-41E7-9689-E795DE1360D3"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50C72BE7-0E40-4F1A-86D6-15E8C78121C8"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EB5DA1F-3BED-4F23-9FA1-C65F6C59235B"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE08CF54-2259-40AF-B68C-F3498133F490"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:q20100602:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28AF1652-9D3F-45F6-969D-FA0D7F688F12"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t190:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "825B2F91-8AC9-4543-9BD8-26760B5F6587"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t17041702:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "176C1D07-D975-4CF8-B54C-16366DF1C848"}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t18051803:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA65B75F-139F-4BC6-A5AB-EA74FFE5966A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AA638ECA-B29C-415D-99E7-217D16473C37"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:q20100602:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6612C85-1259-4435-BEB1-DC5ADC8D620D"}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t190:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC7D1DBE-4976-47A4-951B-39B5C9B8736A"}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t17041702:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9487774-CE30-4C04-B296-70B3A73225C7"}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t18051803:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0E10BD2-D64F-49F9-8409-A56AC2E0FD57"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "295DF46C-15E0-47A3-8F21-A48F670C0496"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "twcert@cert.org.tw"}