CVE-2023-38028
Estado: ModificadaCrítica (9.1)—
Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Puntuación base: 9.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.88%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-306
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-38028",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-38028",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-10-03T16:04:42.664509Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "twcert@cert.org.tw",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "twcert@cert.org.tw",
"affectedData": [
{
"vendor": "Saho",
"product": "ADM100",
"versions": [
{
"status": "affected",
"version": "0.0.4.0"
},
{
"status": "affected",
"version": "0.0.4.3"
},
{
"status": "affected",
"version": "0.0.4.6"
},
{
"status": "affected",
"version": "0.0.4.8"
},
{
"status": "affected",
"version": "Q20100602"
},
{
"status": "affected",
"version": "T17041702"
},
{
"status": "affected",
"version": "T18051803"
},
{
"status": "affected",
"version": "T190"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Saho",
"product": "ADM-100FP",
"versions": [
{
"status": "affected",
"version": "Q20100602"
},
{
"status": "affected",
"version": "T17041702"
},
{
"status": "affected",
"version": "T18051803"
},
{
"status": "affected",
"version": "T190"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:q20100602:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:t17041702:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:t18051803:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100_firmware:t190:*:*:*:*:*:*:*"
],
"vendor": "saho",
"product": "adm-100_firmware",
"versions": [
{
"status": "affected",
"version": "0.0.4.0"
},
{
"status": "affected",
"version": "0.0.4.3"
},
{
"status": "affected",
"version": "0.0.4.6"
},
{
"status": "affected",
"version": "0.0.4.8"
},
{
"status": "affected",
"version": "q20100602"
},
{
"status": "affected",
"version": "t17041702"
},
{
"status": "affected",
"version": "t18051803"
},
{
"status": "affected",
"version": "t190"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:saho:adm-100fp_firmware:q20100602:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100fp_firmware:t17041702:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100fp_firmware:t18051803:*:*:*:*:*:*:*",
"cpe:2.3:o:saho:adm-100fp_firmware:t190:*:*:*:*:*:*:*"
],
"vendor": "saho",
"product": "adm-100fp_firmware",
"versions": [
{
"status": "affected",
"version": "q20100602"
},
{
"status": "affected",
"version": "t17041702"
},
{
"status": "affected",
"version": "t18051803"
},
{
"status": "affected",
"version": "t190"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2023-08-28T05:15:07.667",
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html",
"tags": [
"Third Party Advisory"
],
"source": "twcert@cert.org.tw"
},
{
"url": "https://www.twcert.org.tw/tw/cp-132-7335-d300a-1.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "twcert@cert.org.tw",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "\nSaho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.\n\n"
},
{
"lang": "es",
"value": "Los dispositivos de asistencia ADM100 y ADM-100FP de Saho tienen una autenticación insuficiente. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad para saltarse la autenticación y leer la información del sistema y operar con los datos del usuario, pero no puede controlar el sistema ni interrumpir el servicio. "
}
],
"lastModified": "2026-06-17T06:09:15.710",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51D8D874-7C51-41E7-9689-E795DE1360D3"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50C72BE7-0E40-4F1A-86D6-15E8C78121C8"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EB5DA1F-3BED-4F23-9FA1-C65F6C59235B"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:0.0.4.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE08CF54-2259-40AF-B68C-F3498133F490"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:q20100602:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28AF1652-9D3F-45F6-969D-FA0D7F688F12"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:t190:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "825B2F91-8AC9-4543-9BD8-26760B5F6587"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:t17041702:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "176C1D07-D975-4CF8-B54C-16366DF1C848"
},
{
"criteria": "cpe:2.3:o:saho:adm-100_firmware:t18051803:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA65B75F-139F-4BC6-A5AB-EA74FFE5966A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:saho:adm-100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AA638ECA-B29C-415D-99E7-217D16473C37"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:q20100602:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6612C85-1259-4435-BEB1-DC5ADC8D620D"
},
{
"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t190:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC7D1DBE-4976-47A4-951B-39B5C9B8736A"
},
{
"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t17041702:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9487774-CE30-4C04-B296-70B3A73225C7"
},
{
"criteria": "cpe:2.3:o:saho:adm-100fp_firmware:t18051803:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0E10BD2-D64F-49F9-8409-A56AC2E0FD57"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:saho:adm-100fp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "295DF46C-15E0-47A3-8F21-A48F670C0496"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "twcert@cert.org.tw"
}