What’s Vulnerable › Vulnerabilities

CVE-2021-35522

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-07-22 · updated 2026-06-17
• Weakness: CWE-787

Description

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.

Affected products

• IDEMIA Ma Vp Md Firmware: all versions
• IDEMIA Morphowave Compact Md Firmware: all versions
• IDEMIA Morphowave Compact Mdpi-M Firmware: before 2.6.2 — fixed in 2.6.2
• IDEMIA Morphowave Compact Mdpi Firmware: before 2.6.2 — fixed in 2.6.2
• IDEMIA Sigma Extreme Firmware: all versions
• IDEMIA Sigma Lite+ Firmware: all versions
• IDEMIA Sigma Lite Firmware: all versions
• IDEMIA Sigma Wide Firmware: all versions
• IDEMIA Visionpass Md Firmware: all versions
• IDEMIA Visionpass Mdpi-M Firmware: before 2.6.2 — fixed in 2.6.2
• IDEMIA Visionpass Mdpi Firmware: before 2.6.2 — fixed in 2.6.2

How to fix

Upgrade to a fixed version: IDEMIA Morphowave Compact Mdpi-M Firmware 2.6.2; IDEMIA Morphowave Compact Mdpi Firmware 2.6.2; IDEMIA Visionpass Mdpi-M Firmware 2.6.2; IDEMIA Visionpass Mdpi Firmware 2.6.2. Check the vendor advisory for mitigations.

References

• https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=true
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=true
• https://www.idemia.com
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=true
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=true
• https://www.idemia.com

Get alerted when CVE-2021-35522 or the next vulnerability affects your stack