CVE-2023-38029

Published: Aug 28, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: twcert@cert.org.tw (Secondary)

Description

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.

Affected (12)

Products: Saho: Adm 100 Firmware, Adm 100fp Firmware

Saho

2 products

Adm 100 Firmware

Adm 100fp Firmware

Configuration A

8 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Saho Adm 100 Firmware	Version 0.0.4.0
Saho Adm 100 Firmware	Version 0.0.4.3
Saho Adm 100 Firmware	Version 0.0.4.6
Saho Adm 100 Firmware	Version 0.0.4.8
Saho Adm 100 Firmware	Version q20100602
Saho Adm 100 Firmware	Version t17041702
Saho Adm 100 Firmware	Version t18051803
Saho Adm 100 Firmware	Version t190

Running on/with	Platform Versions
Saho Adm 100	All versions

Configuration B

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Saho Adm 100fp Firmware	Version q20100602
Saho Adm 100fp Firmware	Version t17041702
Saho Adm 100fp Firmware	Version t18051803
Saho Adm 100fp Firmware	Version t190

Running on/with	Platform Versions
Saho Adm 100fp	All versions

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.