CVE-2023-38028

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-380299.8Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading f CVE-2023-38033.7A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an CVE-2023-380307.5Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated rem CVE-2023-380318.8ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privi CVE-2023-380328.8ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user p CVE-2023-380338.8ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regu CVE-2023-380349.8A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could CVE-2023-380359.8A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass a CVE-2023-380369.8A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overf CVE-2023-380375.5ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to CVE-2023-380397.5When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. Howeve CVE-2023-38049.8A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability af