CVE Vulnerability

CVE-2021-41847

An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software.

6.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gitlab.com/grose88/infinias Exploit Third Party Advisory
https://grant-rose.com/infinias-access-control-vulnerability/ Exploit Third Party Advisory
https://www.3xlogic.com/infinias-access-control Product Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:3xlogic:infinias_access_control:*:*:*:*:*:*:*:*
Information

Published : 2021-10-01 11:15

Updated : 2022-07-12 05:42

NVD link : CVE-2021-41847

Mitre link : CVE-2021-41847

Products Affected

3xlogic

Infinias Access Control

CWE
CWE-639