CVE-2020-3934

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
TAIWAN SECOM CO., LTD.	Door Access Control system	<= 3.3.2
TAIWAN SECOM CO., LTD.	Personnel Attendance system	<= 3.3.0.3_20160517

References

https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760bThird Party Advisory
https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bacThird Party Advisory
https://www.twcert.org.tw/en/cp-139-3318-89f76-2.htmlThird Party Advisory
https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760bThird Party Advisory
https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bacThird Party Advisory
https://www.twcert.org.tw/en/cp-139-3318-89f76-2.htmlThird Party Advisory

Timeline

Published: Feb 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39357.5TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cook CVE-2020-39369.8UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject CVE-2020-39377.5SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary CVE-2020-39387.5SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into ne CVE-2020-39396.1SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked t CVE-2020-39405.9VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.CVE-2020-39417.0The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine CVE-2020-39439.8vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configu CVE-2020-39448.6vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to CVE-2020-39457.5vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due CVE-2020-39467.5InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Bi CVE-2020-39478.8VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. Successful exploitat