Medium severity · published Jul 22, 2021
CVE-2021-35520
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code…
6.2
CVSS
0.3%
EPSS
No
On KEV
Description
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Morphowave Compact Mdpi Firmware · Idemia
before 2.6.2 · source: NVD
MC
Morphowave Compact Mdpi-m Firmware · Idemia
before 2.6.2 · source: NVD
VM
Visionpass Mdpi Firmware · Idemia
before 2.6.2 · source: NVD
VM
Visionpass Mdpi-m Firmware · Idemia
before 2.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35520
Patch
https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=true
Patch
https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=true
Product
https://www.idemia.com
More from Morphowave Compact Mdpi Firmware
9.8
CVE-2021-35522
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7…
5.9
CVE-2021-35521
A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services…