CVE-2021-35522: Idemia Ma Vp Md Firmware

Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days.

A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.

Affected products

• Idemia Ma Vp Md Firmware: affected versions not specified
• Idemia Morphowave Compact Md Firmware: affected versions not specified
• Idemia Morphowave Compact Mdpi-M Firmware: before 2.6.2 (fixed in 2.6.2)
• Idemia Morphowave Compact Mdpi Firmware: before 2.6.2 (fixed in 2.6.2)
• Idemia Sigma Extreme Firmware: affected versions not specified
• Idemia Sigma Lite+ Firmware: affected versions not specified
• Idemia Sigma Lite Firmware: affected versions not specified
• Idemia Sigma Wide Firmware: affected versions not specified
• Idemia Visionpass Md Firmware: affected versions not specified
• Idemia Visionpass Mdpi-M Firmware: before 2.6.2 (fixed in 2.6.2)
• Idemia Visionpass Mdpi Firmware: before 2.6.2 (fixed in 2.6.2)

Published 2021-07-22. Last modified 2026-06-17.