Lucky Technology Attendance Machines Missing Authentication Vulnerability

A vulnerability allowing unauthorized access has been identified in Lucky Technology Ltd's attendance management devices, specifically the LM-520-SC, LM-520-FSC, and LM-520-FSC-SAM models, all versions prior to 20250321. This vulnerability arises from a lack of proper authentication in certain functionalities, enabling remote attackers to access sensitive personnel information and download attendance records from the affected organization.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive employee data and attendance records from the targeted company.

Remediation

It is recommended to implement strict firewall rules to mitigate this vulnerability.