Vulnerability in Commax Co., Ltd. Biometric Access Control System

CVE-2021-47706

COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information and circumvent physical controls in smart homes and buildings by exploiting cookie poisoning. Attackers can forge cookies to bypass authentication and disclose sensitive information.

Published 2025-12-09 · last modified 2026-06-17.

EPSS exploit prediction

EPSS: 0.006 (43.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: -0.000

Affected products

Commax Co., Ltd. Biometric Access Control System — versions 1.0.0

Weakness classification (CWE)

CWE-565 — Reliance on Cookies without Validation and Integrity Checking

References

www.exploit-db.com/exploits/50206 (exploit)
www.commax.com (product)
www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5661.php (third-party-advisory)
www.commax.com/product/ (product)
www.vulncheck.com/advisories/commax-biometric-access-control-system-authenticat… (third-party-advisory)