Description
Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Saho ADM100
Default version status: unaffected
0.0.4.0affected0.0.4.3affected0.0.4.6affected0.0.4.8affectedQ20100602affectedT17041702affectedT18051803affectedT190affected
Saho ADM-100FP
Default version status: unaffected
Q20100602affectedT17041702affectedT18051803affectedT190affected