CVE-2021-41847 - CVE House
Back to Database
Status published High CVE-2021-41847

An issue was discovered in 3xLogic Infinias Access Control through...

Vulnerability Description

An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41847

Credits & Attribution

No credits recorded in the NVD database.

References

More from 3xlogic

View All →
CVE-2020-12681
Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through...
High 7.5
CVE-2020-11542
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication...
Critical 9.8
CVE-2019-18651
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access...
Medium 6.5

Affected Vendor

Affected Software

infinias access control
Vulnerable Versions:
0

Timeline

Official Publish: October 1st, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.