CVE-2019-11523

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-06 · updated 2026-06-17
Weakness: CWE-306

Description

Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users list (which includes RFID codes and passcodes in cleartext), or update/create users. The same attack can be executed on a local network and over the internet (if the device is exposed on a public IP address).

Affected products

Anviz M3 Firmware: all versions

References

https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc
https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc

Get alerted when CVE-2019-11523 or the next vulnerability affects your stack