CVE-2015-5618

Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify (a) Voice Time Set configuration settings via a request to voice.htm or (b) UniFinger configuration settings via a request to bf.htm, a different vulnerability than CVE-2015-2871.

• CWE-264

• http://www.kb.cert.org/vuls/id/360431Third Party Advisory, US Government Resource
• http://www.kb.cert.org/vuls/id/360431Third Party Advisory, US Government Resource

Published

Aug 1, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5611Unspecified vulnerability in Uconnect before 15.26.1, as use…
• CVE-2015-5612Cross-site scripting (XSS) vulnerability in October CMS buil…
• CVE-2015-5613Cross-site scripting (XSS) vulnerability in October CMS buil…
• CVE-2015-5614Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-5615Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-5617SQL injection vulnerability in pub/m_pending_news/delete_pen…9.8
• CVE-2015-5619Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumb…
• CVE-2015-5621The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 …7.5
• CVE-2015-5622Cross-site scripting (XSS) vulnerability in WordPress before…
• CVE-2015-5623WordPress before 4.2.3 does not properly verify the edit_pos…
• CVE-2015-5624Buffer overflow in the ExecCall method in c2lv6.ocx in the F…
• CVE-2015-5625Cross-site scripting (XSS) vulnerability in OpenDocMan befor…