CVE-2023-38029
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Saho's attendance devices ADM100 and ADM-100FP have insufficient filtering for special characters and file types within their file uploading function. This allows an unauthenticated remote attacker to upload and execute arbitrary files, potentially performing arbitrary system commands or disrupting service.
Risk Assessment
The risk to the organization includes the potential for remote execution of unauthorized commands, which could lead to significant service disruptions and potential data loss.
Recommendation
It is recommended to implement proper filtering for uploaded files and restrict access to the file upload function to authorized users only.
Original NVD description (English source)
Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.