CVE-2023-38029 | BDVDB-2026-210539 Detail
SahoADM100
Description#
Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.
Impact#
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
Weaknesses#
- CWE-434 Unrestricted Upload of File with Dangerous Type
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.