CVE-2023-38029 - OpenCVE

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Saho	Adm-100 Adm-100 Firmware Adm-100fp Adm-100fp Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:::::::*
	cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:::::::*
	cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:::::::*
	cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:::::::*
	cpe:2.3:o:saho:adm-100_firmware:q20100602:::::::*
	cpe:2.3:o:saho:adm-100_firmware:t190:::::::*
	cpe:2.3:o:saho:adm-100_firmware:t17041702:::::::*
	cpe:2.3:o:saho:adm-100_firmware:t18051803:::::::*

cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:saho:adm-100fp_firmware:q20100602:::::::*
	cpe:2.3:o:saho:adm-100fp_firmware:t190:::::::*
	cpe:2.3:o:saho:adm-100fp_firmware:t17041702:::::::*
	cpe:2.3:o:saho:adm-100fp_firmware:t18051803:::::::*

cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2023-08-28T05:59:47.039Z

Updated: 2024-08-02T17:23:27.907Z

Reserved: 2023-07-12T00:37:03.717Z

Link: CVE-2023-38029

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-08-28T06:15:07.857

Modified: 2023-08-29T23:46:48.037

Link: CVE-2023-38029

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38029", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-07-12T00:37:03.717Z", "datePublished": "2023-08-28T05:59:47.039Z", "dateUpdated": "2024-08-02T17:23:27.907Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ADM100", "vendor": "Saho", "versions": [{"status": "affected", "version": "0.0.4.0"}, {"status": "affected", "version": "0.0.4.3"}, {"status": "affected", "version": "0.0.4.6"}, {"status": "affected", "version": "0.0.4.8"}, {"status": "affected", "version": "Q20100602"}, {"status": "affected", "version": "T17041702"}, {"status": "affected", "version": "T18051803"}, {"status": "affected", "version": "T190"}]}, {"defaultStatus": "unaffected", "product": "ADM-100FP", "vendor": "Saho", "versions": [{"status": "affected", "version": "Q20100602"}, {"status": "affected", "version": "T17041702"}, {"status": "affected", "version": "T18051803"}, {"status": "affected", "version": "T190"}]}], "datePublic": "2023-08-31T01:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Saho\u2019s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.</span>\n\n"}], "value": "\nSaho\u2019s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.\n\n"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T05:59:47.039Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n\n\nContact support from Saho.<br>"}], "value": "\n\n\nContact support from Saho.\n"}], "source": {"advisory": "TVN-202308009", "discovery": "EXTERNAL"}, "title": "Saho ADM100&ADM-100FP - Arbitrary File Upload", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.907Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "51D8D874-7C51-41E7-9689-E795DE1360D3", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "50C72BE7-0E40-4F1A-86D6-15E8C78121C8", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:*:*:*:*:*:*:*", "matchCriteriaId": "5EB5DA1F-3BED-4F23-9FA1-C65F6C59235B", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:*:*:*:*:*:*:*", "matchCriteriaId": "BE08CF54-2259-40AF-B68C-F3498133F490", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:q20100602:*:*:*:*:*:*:*", "matchCriteriaId": "28AF1652-9D3F-45F6-969D-FA0D7F688F12", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t190:*:*:*:*:*:*:*", "matchCriteriaId": "825B2F91-8AC9-4543-9BD8-26760B5F6587", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t17041702:*:*:*:*:*:*:*", "matchCriteriaId": "176C1D07-D975-4CF8-B54C-16366DF1C848", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100_firmware:t18051803:*:*:*:*:*:*:*", "matchCriteriaId": "BA65B75F-139F-4BC6-A5AB-EA74FFE5966A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:*", "matchCriteriaId": "AA638ECA-B29C-415D-99E7-217D16473C37", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:q20100602:*:*:*:*:*:*:*", "matchCriteriaId": "D6612C85-1259-4435-BEB1-DC5ADC8D620D", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t190:*:*:*:*:*:*:*", "matchCriteriaId": "EC7D1DBE-4976-47A4-951B-39B5C9B8736A", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t17041702:*:*:*:*:*:*:*", "matchCriteriaId": "C9487774-CE30-4C04-B296-70B3A73225C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t18051803:*:*:*:*:*:*:*", "matchCriteriaId": "D0E10BD2-D64F-49F9-8409-A56AC2E0FD57", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:*", "matchCriteriaId": "295DF46C-15E0-47A3-8F21-A48F670C0496", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "\nSaho\u2019s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.\n\n"}], "id": "CVE-2023-38029", "lastModified": "2023-08-29T23:46:48.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Primary"}]}, "published": "2023-08-28T06:15:07.857", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "twcert@cert.org.tw", "type": "Primary"}]}