CVE-2021-35522
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.66% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- idemia/morphowave compact mdpi firmware · idemia/morphowave compact mdpi-m firmware · idemia/visionpass mdpi firmware · idemia/visionpass mdpi-m firmware · idemia/visionpass md firmware · idemia/morphowave compact md firmware · idemia/sigma lite firmware · idemia/sigma lite\+ firmware · idemia/sigma wide firmware · idemia/sigma extreme firmware · idemia/ma vp md firmware
- Source
- cve@mitre.org
References
- https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=truePatch, Vendor Advisory
- https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=truePatch, Vendor Advisory
- https://www.idemia.comProduct
- https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=truePatch, Vendor Advisory
- https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=truePatch, Vendor Advisory
- https://www.idemia.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.