« Volver al listado

CVE-2021-35962

Estado: ModificadaAlta (7.5)—

Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Secom — Door Access ControlSecom — Personnel Attendance System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-35962",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "TAIWAN SECOM CO., LTD.,",
          "product": "Door Access Control and Personnel Attendance Management system",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.3.2"
            }
          ],
          "platforms": [
            "Door Access Control"
          ]
        },
        {
          "vendor": "TAIWAN SECOM CO., LTD.,",
          "product": "Door Access Control and Personnel Attendance Management system",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.4.0.0.3.12_20210525"
            }
          ],
          "platforms": [
            "Personnel Attendance system"
          ]
        }
      ]
    }
  ],
  "published": "2021-07-16T16:15:11.023",
  "references": [
    {
      "url": "https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission."
    },
    {
      "lang": "es",
      "value": "Unos parámetros específicos de la página en el sistema Dr. ID Door Access Control and Personnel Attendance Management no filtran los caracteres especiales. Unos atacantes remotos pueden aplicar medios de Salto de Ruta para descargar archivos de credenciales del sistema sin permiso"
    }
  ],
  "lastModified": "2026-06-17T03:58:06.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:secom:door_access_control:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0364F401-A33B-4291-84E9-7F4A47343077",
              "versionEndIncluding": "3.3.2"
            },
            {
              "criteria": "cpe:2.3:a:secom:personnel_attendance_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D70B460F-FDEF-47FC-A9D1-B2B37C376A80",
              "versionEndIncluding": "3.4.0.0.3.12_20210525"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}