PT-2025-54424 · Commax · Commax Biometric Access Control System

Published 2025-12-31 · Updated 2025-12-31 · CVE-2021-47743

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions COMMAX Biometric Access Control System version 1.0.0

Description The COMMAX Biometric Access Control System is affected by a reflected cross-site scripting issue that does not require authentication. The issue resides in cookie parameters CMX ADMIN NM and CMX COMPLEX NM. An attacker can inject malicious HTML and JavaScript code into these cookie values, leading to the execution of arbitrary scripts within a victim’s browser session.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing the CMX ADMIN NM and CMX COMPLEX NM cookie parameters to prevent the injection of malicious code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47743

Affected Products

Commax Biometric Access Control System

References · 8

• 🔥 https://packetstormsecurity.com/files/163834 · Exploit
• https://commax.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47743 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/207578 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2021-5660.php · Note
• https://cxsecurity.com/issue/WLB-2021080063 · Note
• https://twitter.com/CVEnew/status/2006495383157907769 · Twitter Post
• https://vulncheck.com/advisories/commax-biometric-access-control-system-reflected-xss-via-cookie-parameters · Note