CVE-2022-26671 - Vulnerability Details - OpenCVE

Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Secom	Dr.id Access Control Dr.id Attendance System

Configuration 1 [-]

OR	cpe:2.3:a:secom:dr.id_access_control:3.3.2:::::::*
	cpe:2.3:a:secom:dr.id_attendance_system:3.4.0.0.3.11:::::::*

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2022-04-07T18:22:40.988495Z

Updated: 2024-09-17T00:31:07.808Z

Reserved: 2022-03-08T00:00:00

Link: CVE-2022-26671

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-07T19:15:09.010

Modified: 2024-11-21T06:54:18.050

Link: CVE-2022-26671

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Personnel Attendance Management system", "vendor": "TAIWAN SECOM CO., LTD.,", "versions": [{"status": "affected", "version": "3.4.0.0.3.11"}]}], "datePublic": "2022-03-31T00:00:00", "descriptions": [{"lang": "en", "value": "Taiwan Secom Dr.ID Access Control system\u2019s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-07T18:22:40", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html"}], "solutions": [{"lang": "en", "value": "Update Personnel Attendance system to v3.4.0.0.3.13_20211214"}], "source": {"advisory": "TVN-202203004", "discovery": "EXTERNAL"}, "title": "TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2022-03-31T02:30:00.000Z", "ID": "CVE-2022-26671", "STATE": "PUBLIC", "TITLE": "TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Personnel Attendance Management system", "version": {"version_data": [{"version_affected": "=", "version_value": "3.4.0.0.3.11"}]}}]}, "vendor_name": "TAIWAN SECOM CO., LTD.,"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Taiwan Secom Dr.ID Access Control system\u2019s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-798 Use of Hard-coded Credentials"}]}]}, "references": {"reference_data": [{"name": "https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html", "refsource": "MISC", "url": "https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html"}]}, "solution": [{"lang": "en", "value": "Update Personnel Attendance system to v3.4.0.0.3.13_20211214"}], "source": {"advisory": "TVN-202203004", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:11:44.025Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html"}]}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2022-26671", "datePublished": "2022-04-07T18:22:40.988495Z", "dateReserved": "2022-03-08T00:00:00", "dateUpdated": "2024-09-17T00:31:07.808Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:secom:dr.id_access_control:3.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "D4A5D733-9622-42E5-9CA2-0CC1FC75D822", "vulnerable": true}, {"criteria": "cpe:2.3:a:secom:dr.id_attendance_system:3.4.0.0.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "D148F97E-F617-4EFC-B559-FF46F32FA614", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Taiwan Secom Dr.ID Access Control system\u2019s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service."}, {"lang": "es", "value": "La p\u00e1gina de inicio de sesi\u00f3n de Taiwan Secom Dr.ID Access Control system presenta una credencial embebida en el c\u00f3digo fuente. Un atacante remoto no autenticado puede usar la credencial embebida para adquirir informaci\u00f3n parcial del sistema y modificar la configuraci\u00f3n del sistema para causar una interrupci\u00f3n parcial del servicio"}], "id": "CVE-2022-26671", "lastModified": "2024-11-21T06:54:18.050", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "twcert@cert.org.tw", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-07T19:15:09.010", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-5971-b691f-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "twcert@cert.org.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}