CVE-2022-26671 PoC — TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials

Source

https://github.com/DefensiveOrigins/POC-CVE-2022-26671

Associated Vulnerability

Title:TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials (CVE-2022-26671)
Description:Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service.

Readme

If you got here, you know why this repo needed created. 

CVE-2022-26671

GET /AT/ATDefault.aspx

Line's 430 contains the cleartext credential.

secom | supervisor

In regards to to responsible disclosure, not dislcosing a hardcoded cleartext HTTP body response is silly when its the login page./ 

https://nvd.nist.gov/vuln/detail/CVE-2022-26671

File Snapshot

Log in to view the POC file snapshot cached by Shenlong Bot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →