CVE-2021-35961
📋 TL;DR
Dr. ID Door Access Control and Personnel Attendance Management systems have hardcoded default admin credentials, allowing remote attackers to gain full administrative access. This affects all systems using default configurations, potentially compromising physical security controls and sensitive personnel data.
💻 Affected Systems
- Dr. ID Door Access Control and Personnel Attendance Management system
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing attackers to disable physical security, modify access logs, steal sensitive personnel data, and potentially pivot to other connected systems.
Likely Case
Unauthorized access to door control systems, attendance records theft, and potential physical security breaches at affected facilities.
If Mitigated
Limited impact if credentials were changed during initial setup, though systems remain vulnerable to credential guessing attacks.
🎯 Exploit Status
Attack requires only knowledge of default credentials and network access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.twcert.org.tw/tw/cp-132-4905-c99ac-1.html
Restart Required: No
Instructions:
1. Log into the Dr. ID system admin interface
2. Navigate to user management settings
3. Change the default admin password to a strong, unique password
4. Verify the new credentials work and old ones are disabled
🔧 Temporary Workarounds
Network Segmentation
allIsolate Dr. ID systems from internet and restrict internal network access
Access Control Lists
allImplement firewall rules to restrict access to Dr. ID systems
🧯 If You Can't Patch
- Immediately change all default admin passwords to strong, unique credentials
- Implement network segmentation to isolate Dr. ID systems from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the Dr. ID admin interface using default credentials (check vendor documentation for specifics)Check Version:
Check system version through admin interface or device labelingVerify Fix Applied:
Verify default credentials no longer work and only new strong credentials provide access📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful admin login
- Admin login from unusual IP addresses or locations
- Configuration changes from unexpected sources
Network Indicators:
- Unusual traffic patterns to/from Dr. ID systems
- Authentication requests to admin interfaces from external networks
SIEM Query:
source="dr-id-system" AND (event_type="authentication" AND result="success" AND user="admin")