CVE-2023-38030

Published: Aug 28, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: twcert@cert.org.tw (Secondary)

Description

Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.

Affected (12)

Products: Saho: Adm 100 Firmware, Adm 100fp Firmware

Saho

2 products

Adm 100 Firmware

Adm 100fp Firmware

Configuration A

8 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Saho Adm 100 Firmware	Version 0.0.4.0
Saho Adm 100 Firmware	Version 0.0.4.3
Saho Adm 100 Firmware	Version 0.0.4.6
Saho Adm 100 Firmware	Version 0.0.4.8
Saho Adm 100 Firmware	Version q20100602
Saho Adm 100 Firmware	Version t17041702
Saho Adm 100 Firmware	Version t18051803
Saho Adm 100 Firmware	Version t190

Running on/with	Platform Versions
Saho Adm 100	All versions

Configuration B

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Saho Adm 100fp Firmware	Version q20100602
Saho Adm 100fp Firmware	Version t17041702
Saho Adm 100fp Firmware	Version t18051803
Saho Adm 100fp Firmware	Version t190

Running on/with	Platform Versions
Saho Adm 100fp	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://www.twcert.org.tw/tw/cp-132-7337-501df-1.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-7337-501df-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.