CVE-2023-38028

moderate-risk

Published 2023-08-28

Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Affected Products (12)

Adm-100 Firmware

Adm-100Fp Firmware

Affected Vendors

Saho

References (2)

Third Party Advisory https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html

/ 100

moderate-risk

Severity 31/34 · Critical

Exploitability 0/34 · Minimal

Exposure 17/34 · Moderate