CVE-2021-35521
Medium
Description
A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.
SeverityMedium
CVSS5.9
Exploit probability—
ProductIdemia Visionpass Mdpi Firmware
PublishedJul 22, 2021
First seenJul 22, 2021
How to fix
Update
- idemia visionpass_mdpi_firmware2.6.2 or later
- idemia morphowave_compact_mdpi_firmware2.6.2 or later
- idemia morphowave_compact_mdpi-m_firmware2.6.2 or later
- idemia visionpass_mdpi-m_firmware2.6.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| idemia visionpass_mdpi_firmware | v < 2.6.2 | 2.6.2 |
| idemia morphowave_compact_mdpi_firmware | v < 2.6.2 | 2.6.2 |
| idemia morphowave_compact_mdpi-m_firmware | v < 2.6.2 | 2.6.2 |
| idemia visionpass_mdpi-m_firmware | v < 2.6.2 | 2.6.2 |
| idemia visionpass_md_firmware | No range specified | — |
| idemia morphowave_compact_md_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.