{"id":"CVE-2015-6839","aliases":["EUVD-2015-6775","GHSA-fhgc-2x58-cm2p"],"status":"published","title":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one...","description":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.","severity":{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00396,"percentile":0.34012,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2017-10-23T18:00:00Z","modified":"2026-06-17T00:31:30Z","products":[{"vendor":"grupo_msa","product":"vot.ar"}],"references":[{"url":"https://docs.google.com/document/d/1aH6kvoLR8O1qWOpEz89FAB2xFcBNB-QqHgZpXxg0vGE/preview?sle=true\u0026pli=1","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://docs.google.com/document/d/13t1jqu-Upj4SyjYBMj3OMshdy6rGBrnb1R3P-goz-cs/edit?pli=1","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://www.eleccionesciudad.gob.ar/uploads/resoluciones/Informe_05-BALOTAJE-2015-07-17.pdf","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://www.youtube.com/watch?v=CTOCspLn6Zk","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6839"},{"url":"https://github.com/advisories/GHSA-fhgc-2x58-cm2p"}],"sources":{"cve":[{"id":"CVE-2015-6839","description":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.","status":"published","published":"2017-10-23T18:00:00Z","modified":"2024-08-06T07:36:33.417Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2015-6775","description":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.","status":"published","published":"2017-10-23T18:00:00Z","modified":"2024-08-06T07:36:33Z","updated_at":"2026-11-03T02:21:54.34629Z"}],"ghsa":[{"id":"GHSA-fhgc-2x58-cm2p","title":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one...","description":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.","status":"published","published":"2022-05-17T00:23:22Z","modified":"2023-02-03T05:01:37Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:53:00.497966Z"}],"nvd":[{"id":"CVE-2015-6839","description":"The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.","status":"published","published":"2017-10-23T18:29:00.837Z","modified":"2026-06-17T00:31:30.757Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:19.244941Z"}]}}