CVE-2021-35520: Idemia Morphowave Compact Mdpi-M Firmware

Medium severity, CVSS 6.2. EPSS: 0.3% chance of exploitation in the next 30 days.

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.

Affected products

• Idemia Morphowave Compact Mdpi-M Firmware: before 2.6.2 (fixed in 2.6.2)
• Idemia Morphowave Compact Mdpi Firmware: before 2.6.2 (fixed in 2.6.2)
• Idemia Visionpass Mdpi-M Firmware: before 2.6.2 (fixed in 2.6.2)
• Idemia Visionpass Mdpi Firmware: before 2.6.2 (fixed in 2.6.2)

Published 2021-07-22. Last modified 2026-06-17.