Vulnerabilidades de COMMAX Co., Ltd.
CVEs publicadas que afetam produtos de COMMAX Co., Ltd.: 6 registro(s), com severidade, exploração e correções.
COMMAX Biometric Access Control System 2COMMAX UMS Client ActiveX Control 1COMMAX CVD-Axx DVR 1Smart Home IoT Control System 1COMMAX WebViewer ActiveX Control 1
CVE-2021-47743
Média · 6.1
CWE-79 31/12/2025
COMMAX Biometric Access Control System 1.0.0 Reflected XSS via Cookie Parameters
COMMAX Biometric Access Control System 1.0.0 contains an unauthenticated reflected cross-site scripting vulnerability in cookie parameters 'CMX_ADMIN_NM' and 'CMX_COMPLEX_NM'. Attackers can inject malicious HTML and JavaScript code into these cookie values to execute arbitrary scripts in a victim's browser session.
CVE-2021-47719
Alta · 8.7
CWE-787 09/12/2025
CNC_Ctrl DllUnregisterServer f5501 Access Violation
COMMAX WebViewer ActiveX Control 2.1.4.5 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by providing excessively long string arrays through multiple functions. Attackers can exploit boundary errors in Commax_WebViewer.ocx to cause buffer overflow conditions and potentially gain code execution.
CVE-2021-47708
Crítica · 9.3
CWE-89 09/12/2025
COMMAX Smart Home IoT Control System SQL Injection Authentication Bypass
COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Attackers can exploit this by sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.
CVE-2021-47707
Crítica · 9.3
CWE-1392 09/12/2025
COMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure
COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. Attackers can exploit this by sending a POST request with the 'passkey' parameter set to '1234', allowing them to access the web control panel.
CVE-2021-47706
Alta · 8.7
CWE-565 09/12/2025
COMMAX Biometric Access Control System Authentication Bypass
COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information and circumvent physical controls in smart homes and buildings by exploiting cookie poisoning. Attackers can forge cookies to bypass authentication and disclose sensitive information.
CVE-2021-47705
Alta · 8.7
CWE-787 09/12/2025
CNC_Ctrl DllUnregisterServer Access Violation
COMMAX UMS Client ActiveX Control 1.7.0.2 contains a heap-based buffer overflow vulnerability that allows attackers to execute arbitrary code by providing excessively long string arrays through multiple functions. Attackers can exploit improper boundary validation in CNC_Ctrl.dll to cause heap corruption and potentially gain system-level access.