Lucene search

[email protected]CVE-2021-35522

HistoryJul 22, 2021 - 12:15 p.m.

CVE-2021-35522

2021-07-2212:15:08

CWE-787

[email protected]

web.nvd.nist.gov

cve

buffer overflow

thrift

idemia morpho wave compact

visionpass

code execution

denial of service

information disclosure

tcp/ip

nvd

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:P/I:P/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.

Affected configurations

NVD

Node

idemiamorphowave_compact_mdpi_firmwareRange<2.6.2

AND

idemiamorphowave_compact_mdpiMatch-

Node

idemiamorphowave_compact_mdpi-m_firmwareRange<2.6.2

AND

idemiamorphowave_compact_mdpi-mMatch-

Node

idemiavisionpass_mdpi_firmwareRange<2.6.2

AND

idemiavisionpass_mdpiMatch-

Node

idemiavisionpass_mdpi-m_firmwareRange<2.6.2

AND

idemiavisionpass_mdpi-mMatch-

Node

idemiavisionpass_mdMatch2.6.2

AND

idemiavisionpass_md_firmwareMatch-

Node

idemiamorphowave_compact_mdMatch2.6.2

AND

idemiamorphowave_compact_md_firmwareMatch-

Node

idemiasigma_liteMatch4.9.4

AND

idemiasigma_lite_firmwareMatch-

Node

idemiasigma_lite\+Match4.9.4

AND

idemiasigma_lite\+_firmwareMatch-

Node

idemiasigma_wideMatch4.9.4

AND

idemiasigma_wide_firmwareMatch-

Node

idemiasigma_extremeMatch4.9.4

AND

idemiasigma_extreme_firmwareMatch-

Node

idemiama_vp_mdMatch4.9.7

AND

idemiama_vp_md_firmwareMatch-

Node

idemiavisionpass_mdMatch2.6.2

AND

idemiavisionpass_md_firmwareMatch-

Node

idemiamorphowave_compact_md_firmwareMatch-

AND

idemiamorphowave_compact_mdMatch2.6.2

CPENameOperatorVersion
idemia:morphowave_compact_mdpi_firmwareidemia morphowave compact mdpi firmwarelt2.6.2

CPE	Name	Operator	Version
idemia:morphowave_compact_mdpi_firmware	idemia morphowave compact mdpi firmware	lt	2.6.2

References

biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=true

biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=true

www.idemia.com

Social References

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:P/I:P/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

Related for CVE-2021-35522

cvelist1 prion1 nvd1