CVE-2023-38028
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Saho's attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data.
Risk Assessment
The organization may be exposed to unauthorized access to user data, potentially leading to privacy breaches and information security issues.
Recommendation
It is recommended to update the devices to the latest software version to patch this vulnerability and implement additional security measures such as access monitoring.
Original NVD description (English source)
Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.