Vulnerability in Secom Dr.id Access Control
CVE-2020-3935
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.009 (59.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Secom Dr.id Access Control — versions 3.3.2
- Secom Dr.id Attendance System
- Taiwan Secom Co., Ltd. Door Access Control System — versions 0
- Taiwan Secom Co., Ltd. Personnel Attendance System — versions 0
Weakness classification (CWE)
References
- www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac (Third Party Advisory)
- gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b (Third Party Advisory)
- www.twcert.org.tw/en/cp-139-3319-d7b65-2.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-3935?
- CVE-2020-3935 is a high-severity vulnerability in Secom Dr.id Access Control, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.5/10. Published 2020-02-11.
- How severe is CVE-2020-3935?
- High severity. CVSS v3 base score is 7.5 out of 10.