PT-2021-21082 · Unknown · Door Access Control/Personnel Attendance Management System

Tony Kuo · Published 2021-07-16 · Updated 2021-08-02 · CVE-2021-35962

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Dr. ID Door Access Control and Personnel Attendance Management system (affected versions not specified)

Description: The issue concerns the Dr. ID Door Access Control and Personnel Attendance Management system, where specific page parameters do not filter special characters. This allows remote attackers to use Path Traversal techniques to download credential files from the system without permission.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-35962

Affected Products

Door Access Control/Personnel Attendance Management System

References · 4

• https://osv.dev/vulnerability/CVE-2021-35962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35962 · Security Note
• https://twcert.org.tw/tw/cp-132-4906-89381-1.html · Note
• https://chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054 · Note