CVE-2021-35962: TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Path Traversal

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-16 · updated 2026-06-17
Weakness: CWE-22

Description

Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission.

Affected products

SECOM Door Access Control: through 3.3.2
TAIWAN SECOM CO., LTD. Personnel Attendance system: through 3.4.0.0.3.12_20210525

References

https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054
https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html
https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054
https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html

Get alerted when CVE-2021-35962 or the next vulnerability affects your stack