Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-38030

Saho ADM100&ADM-100FP - Execute Code

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
twcert

Description

Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Saho ADM100

Default version status: unaffected

  • 0.0.4.0affected
  • 0.0.4.3affected
  • 0.0.4.6affected
  • 0.0.4.8affected
  • Q20100602affected
  • T17041702affected
  • T18051803affected
  • T190affected

Saho ADM-100FP

Default version status: unaffected

  • Q20100602affected
  • T17041702affected
  • T18051803affected
  • T190affected

References