CVE-2021-35520

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.

• CWE-787

• https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=truePatch, Vendor Advisory
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=truePatch, Vendor Advisory
• https://www.idemia.comProduct
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa0zAAD?sharing=truePatch, Vendor Advisory
• https://biometricdevices.idemia.com/s/global-search/0696700000JJa1nAAD?sharing=truePatch, Vendor Advisory
• https://www.idemia.comProduct

Published

Jul 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35513Mermaid before 8.11.0 allows XSS when the antiscript feature…6.1
• CVE-2021-35514Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection…9.8
• CVE-2021-35515When reading a specially crafted 7Z archive, the constructio…7.5
• CVE-2021-35516When reading a specially crafted 7Z archive, Compress can be…7.5
• CVE-2021-35517When reading a specially crafted TAR archive, Compress can b…7.5
• CVE-2021-3552A Server-Side Request Forgery (SSRF) vulnerability in the EP…7.5
• CVE-2021-35521A path traversal in Thrift command handlers in IDEMIA Morpho…5.9
• CVE-2021-35522A Buffer Overflow in Thrift command handlers in IDEMIA Morph…9.8
• CVE-2021-35523Securepoint SSL VPN Client v2 before 2.0.32 on Windows has u…7.8
• CVE-2021-35525PostSRSd before 1.11 allows a denial of service (subprocess …5.3
• CVE-2021-35526Backup file without encryption vulnerability is found in Hit…7.8
• CVE-2021-35527Password autocomplete vulnerability in the web application p…7.5