CVE-2014-2938 Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands.
HighCVSS 8.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hanon faceid f810 firmware | <= 1.007.109 | No fix listed |
| hanon faceid | = f810 | No fix listed |
| hanon faceid | = f710 | No fix listed |
| hanon faceid | = fk800 | No fix listed |
| hanon faceid | = fa007 | No fix listed |
| hanon faceid f710 firmware | = 1.007.109 | No fix listed |
| hanon faceid fk800 firmware | <= 1.007.109 | No fix listed |
| hanon faceid fa007 firmware | <= 1.007.109 | No fix listed |
References
- VU#767044 third-party-advisory us-government-resource