CVE-2023-38029

high-risk

Published 2023-08-28

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.

Do I need to act?

0.28% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (12)

Adm-100 Firmware

Adm-100Fp Firmware

Affected Vendors

Saho

References (2)

Third Party Advisory https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 1/34 · Minimal

Exposure 17/34 · Moderate