CVE-2021-35521

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=truePatch, Vendor Advisory
https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=truePatch, Vendor Advisory
https://www.idemia.comProduct
https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=truePatch, Vendor Advisory
https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=truePatch, Vendor Advisory
https://www.idemia.comProduct

Timeline

Published: Jul 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-355229.8A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, CVE-2021-355237.8Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHO CVE-2021-355255.3PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated em CVE-2021-355267.8Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access CVE-2021-355277.5Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to CVE-2021-355287.1Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty CVE-2021-355297.2Insufficiently Protected Credentials vulnerability in client environment of Hitachi ABB Power Grids Retail Operations and Counterparty Settl CVE-2021-35537.5A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use CVE-2021-355306.7A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a to CVE-2021-355316.7Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows a CVE-2021-355326.7A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attack CVE-2021-355337.5Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hi