Vendors / HID Global Records 18 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 10
Exploited now HID Global records in CISA KEV No HID Global vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 47
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02444 · Published 2022-06-06 · Fixed in 1.302, 1.296 CWE-693
Priority MEDIUM 46
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01643 · Published 2022-06-06 · Fixed in 1.302, 1.296 CWE-120
Priority MEDIUM 43
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem.
CVSS 3.1 CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.01828 · Published 2022-06-06 · Fixed in 1.271 CWE-22
Priority MEDIUM 41
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.014 · Published 2022-06-06 · Fixed in 1.303, 1.297 CWE-78
Priority LOW 35
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01065 · Published 2022-06-06 · Fixed in 1.29 CWE-425
Priority LOW 35
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01064 · Published 2022-06-06 · Fixed in 1.29 CWE-120
Priority LOW 35
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS).
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00979 · Published 2022-06-06 · Fixed in 1.302, 1.296 CWE-425
Priority LOW 26
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00847 · Published 2022-06-06 · Fixed in 1.29 CWE-425
Open these records in search → All records by CVSS severity
4 10 4 0 0
THREATIST.IORead the docs