Vulnerability information

2023

2023.09.29

Multiple CVE fixed for vulnerabilities discovered in Physical Access control devices. They can under certain circumstances lead to arbitrary code execution, or to permanent denial of service.

2023.09.22

CVE-2023-4667: Stored Cross Site Scripting in webserver administration – The web interface of the impacted device allows the administrator user profile to store malicious scripts in certain fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver. Resulting in scripts execution in the targeted user web browser.

2021

2021.06.28

CVE-2021-35522: A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.

2021.06.28

CVE-2021-35521: A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.

2021.06.28

CVE-2021-35520: A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.

Unlock the world