External risk intelligence

Saho ADM-100 File Upload Vulnerability Allows Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-38029

The affected products are physical attendance devices. While these devices are network-connected, they are typically deployed within private, localized networks for workforce management and are not designed to be directly exposed to the public internet in common deployment scenarios.

Unrestricted File Upload

Saho Adm 100 Firmware

0.0.4.00.0.4.30.0.4.60.0.4.8q20100602t190t17041702t18051803

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Saho attendance devices, allowing unauthenticated remote attackers to upload and execute arbitrary files. This could lead to system command execution or service disruption. The main concern is confirming relevance and exposure within your environment.

Unauthenticated attackers can execute commands.
Critical flaw in attendance devices requires awareness.
Verify if these specific attendance devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a malicious file to Saho attendance devices. These devices lack proper checks for special characters and file types during uploads, allowing an unauthenticated remote attacker to execute arbitrary commands or disrupt the service.

No authentication required for access.
Uploading crafted special characters or files.
Execute commands or disrupt service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to upload and execute arbitrary files on Saho attendance devices. This could lead to the execution of system commands or disruption of the device's service.

Attendance device firmware.
Uploading malicious files via the device's function.
System command execution or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of Saho attendance devices likely falls to facilities or IT operations teams responsible for physical security and building access systems, with vendor management playing a role in coordinating with Saho. The first practical step is to inventory these devices, confirm their network accessibility and business criticality, and identify the specific team accountable for their management and maintenance.

Facilities or IT operations teams own the issue.
Verify device network exposure and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Saho ADM-100 series and how is it used?

The Saho ADM-100 and ADM-100FP are hardware-based attendance tracking systems. Organizations use these devices to manage employee timekeeping and clock-in processes. They run specific firmware that handles user data and administrative tasks, often connecting to local networks to sync records with centralized management software.

What does CWE-434 mean regarding CVE-2023-38029?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this CVE, the device fails to properly validate the files users send to it. Because it does not filter special characters or check file extensions, the system treats uploaded files as trusted, allowing the device to mistakenly execute malicious code embedded within them.

How does an attacker trigger this vulnerability?

An attacker triggers the bug by sending a crafted file to the device through its upload function. Because the system lacks authentication and input filtering, it processes these files immediately. The vulnerability is not triggered by normal, authorized administrative updates or standard network traffic that does not attempt to bypass file upload restrictions.

Is my network at risk from this Saho device?

According to Halo Surface Signal, these devices are typically found on private, localized networks rather than the public internet. While the vulnerability allows remote execution, your actual risk depends on whether these devices were incorrectly exposed to the internet. If they remain segmented within a private office network, the potential for external exploitation is significantly reduced.

How should I respond if I use these Saho devices?

Start by identifying the physical location and network placement of all ADM-100 units in your facility. Coordinate with the team responsible for building security or IT infrastructure to audit their network access. Ensure these devices are not reachable from outside your internal network and contact the vendor to obtain the necessary firmware updates to patch the upload validation flaw.

References

www.twcert.org.tw/tw/cp-132-7336-35a94-1.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.