What’s Vulnerable › Vulnerabilities

CVE-2021-35520

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-07-22 · updated 2026-06-17
• Weakness: CWE-787

Description

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.

Affected products

• IDEMIA Morphowave Compact Mdpi-M Firmware: before 2.6.2 — fixed in 2.6.2
• IDEMIA Morphowave Compact Mdpi Firmware: before 2.6.2 — fixed in 2.6.2
• IDEMIA Visionpass Mdpi-M Firmware: before 2.6.2 — fixed in 2.6.2
• IDEMIA Visionpass Mdpi Firmware: before 2.6.2 — fixed in 2.6.2

How to fix

Upgrade to a fixed version: IDEMIA Morphowave Compact Mdpi-M Firmware 2.6.2; IDEMIA Morphowave Compact Mdpi Firmware 2.6.2; IDEMIA Visionpass Mdpi-M Firmware 2.6.2; IDEMIA Visionpass Mdpi Firmware 2.6.2. Check the vendor advisory for mitigations.

References

• https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=true
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=true
• https://www.idemia.com
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=true
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=true
• https://www.idemia.com

Get alerted when CVE-2021-35520 or the next vulnerability affects your stack