Multiple models of Chiyu Technology fingerprint access control devices contain a cross-site scripting (XSS) vulnerability and an authentication bypass vulnerability.
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CVE-2015-2870
According to the reporter, <script> tags are not filtered out of a URL passed to the device, allowing an attacker to perform a reflected XSS attack.
An unauthenticated remote attacker may be able to view or modify device configuration, or obtain user credentials.
The CERT/CC is currently unaware of a practical solution to this problem.
Thanks to Maxim Rupp for reporting this vulnerability to us.
This document was written by Garret Wassermann.