Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2021-35521: A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information dis...
CVE-2021-35521 · published 5 years ago
Summary
A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.
What to do
- Update idemia morphowave_compact_mdpi_firmware to version 2.6.2 or later.
- Update idemia morphowave_compact_mdpi-m_firmware to version 2.6.2 or later.
- Update idemia visionpass_mdpi_firmware to version 2.6.2 or later.
- Update idemia visionpass_mdpi-m_firmware to version 2.6.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| idemia | morphowave_compact_mdpi_firmware |
< 2.6.2 cpe:2.3:o:idemia:morphowave_compact_mdpi_firmware:*:*:*:*:*:*:*:* |
| idemia | morphowave_compact_mdpi-m_firmware |
< 2.6.2 cpe:2.3:o:idemia:morphowave_compact_mdpi-m_firmware:*:*:*:*:*:*:*:* |
| idemia | visionpass_mdpi_firmware |
< 2.6.2 cpe:2.3:o:idemia:visionpass_mdpi_firmware:*:*:*:*:*:*:*:* |
| idemia | visionpass_mdpi-m_firmware |
< 2.6.2 cpe:2.3:o:idemia:visionpass_mdpi-m_firmware:*:*:*:*:*:*:*:* |
| idemia | visionpass_md_firmware |
All versions
cpe:2.3:o:idemia:visionpass_md_firmware:-:*:*:*:*:*:*:* |
| idemia | morphowave_compact_md_firmware |
All versions
cpe:2.3:o:idemia:morphowave_compact_md_firmware:-:*:*:*:*:*:*:* |
Original advisory text
A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information dis...
A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.
References
- https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=t... Patch Vendor Advisory
- https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=t... Patch Vendor Advisory
- https://www.idemia.com Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-22Path Traversal
Timeline
Published22 Jul 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-35521 · NVD
Track software like this
Free during beta