Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
29 Aug 2023, 23:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Saho
Saho adm-100 Firmware Saho adm-100fp Firmware Saho adm-100fp Saho adm-100 |
|
| References | (MISC) https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html - Third Party Advisory | |
| CPE | cpe:2.3:o:saho:adm-100fp_firmware:q20100602:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100fp_firmware:t18051803:*:*:*:*:*:*:* cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:t190:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:t17041702:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100fp_firmware:t190:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100fp_firmware:t17041702:*:*:*:*:*:*:* cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:t18051803:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:q20100602:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:*:*:*:*:*:*:* cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:*:*:*:*:*:*:* |
28 Aug 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-28 06:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-38029
Mitre link : CVE-2023-38029
CVE.ORG link : CVE-2023-38029
JSON object : View
Products Affected
saho
- adm-100_firmware
- adm-100fp
- adm-100
- adm-100fp_firmware
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type