CVEvulnerability

CVE-2023-38028

9.1 CRITICAL Published 2023-08-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-08-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-306

Description

Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.

Affected configurations

• saho adm-100 firmware 0.0.4.0 • saho adm-100 firmware 0.0.4.3 • saho adm-100 firmware 0.0.4.6 • saho adm-100 firmware 0.0.4.8 • saho adm-100 firmware q20100602 • saho adm-100 firmware t190 • saho adm-100 firmware t17041702 • saho adm-100 firmware t18051803 • saho adm-100fp firmware q20100602 • saho adm-100fp firmware t190 • saho adm-100fp firmware t17041702 • saho adm-100fp firmware t18051803

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References