CVE-2021-41847

Katalog CVE

CVSS 8.8 · High EPSS 1,6%

Kerentanan Authorization Bypass Through User-Controlled Key pada 3xlogic infinias access control. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software.

Rincian

Terbit di NVD

1 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.3xlogic.com/infinias-access-control product · advisory vendor
• https://gitlab.com/grose88/infinias exploit · advisory pihak ketiga
• https://grant-rose.com/infinias-access-control-vulnerability/ exploit · advisory pihak ketiga