PT-2020-17811 · Taiwan Secom Co. · Door Access Control/Personnel Attendance Management System

Hans · Published 2020-02-11 · Updated 2021-12-22 · CVE-2020-3935

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TAIWAN SECOM CO., LTD. Door Access Control and Personnel Attendance Management system (affected versions not specified)

Description The system stores users' information in cleartext in the cookie, which allows attackers to obtain passwords.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-3935

Affected Products

Door Access Control/Personnel Attendance Management System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-3935 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3935 · Vendor Advisory
• https://twcert.org.tw/en/cp-139-3319-d7b65-2.html · Note
• https://chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac · Note
• https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b · Note