CVE-2024-7731 CRITICAL

CVE-2024-7731: SECOM Dr.ID Access control system - SQL injection

Vendor Secom
Product Dr.ID Access control system
Weakness CWE-89 · SQLi
Published August 14, 2024
Last update August 14, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

Key dates

02Disclosure timeline

August 14, 2024 CVE published
August 14, 2024 Record updated