A vulnerability was determined in Hanwang e-Face General Management Platform 6

CVE-2026-13547 is an improper access control flaw (CWE-284) in Hanwang e-Face General Management Platform 6.3.5.4 — a Chinese-market on-prem console used to administer facial-recognition turnstiles, door controllers, and attendance terminals. The CVSS string AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L describes a network-reachable endpoint that mishandles authorization checks, but every impact dimension is rated Low: an unauthenticated requester can read, modify, or perturb *some* resource — typically a single record, log entry, or non-privileged setting — not the whole database or admin function.

Vendor severity of HIGH (7.3) is the mechanical CVSS output of PR:N plus three Low impacts; it is not a reflection of real-world danger. The product is a regional, low-deployment, perimeter-internal management console — there is no public PoC, no KEV listing, no GreyNoise/Shodan-tracked tag, no English-language advisory beyond the VulDB-style disclosure. For a fleet running 10,000 hosts in North America or EMEA, the realistic exposure is zero unless you've inherited a Chinese physical-security stack. MEDIUM is the honest call.

Why this verdict

• Impact ceiling is Low/Low/Low. CVSS arithmetic inflates the base to 7.3 because of PR:N, but the realistic outcome is reading or tampering with a single resource — not domain takeover, not RCE, not credential dump.
• Installed-base share is statistically negligible outside mainland China; for North American / EMEA fleets the affected-host count rounds to zero on most asset inventories.
• Role multiplier — physical access plane: worst plausible outcome is enumerating one enrolled face/badge or toggling one log entry. The chain does NOT cross into door-controller firmware or PLC manipulation per the disclosed scope (S:U, A:L), so even the high-value-role outcome stays sub-fleet and sub-safety.
• No exploitation evidence. Not on KEV, no public PoC, no Nuclei template, no GreyNoise tag — exploitation pressure today is effectively zero.
• Friction: deployment topology. e-Face is canonically bound to a segmented physical-security VLAN; reaching the management endpoint from the corporate LAN typically requires a pre-existing foothold or a misconfigured uplink.

Why not higher?

Vendor HIGH (7.3) is mechanical CVSS arithmetic that over-weights PR:N against an all-Low impact triad. There is no KEV listing, no PoC, no fleet-scale role multiplier (the bug is not in a hypervisor, IdP, CA, backup, or kernel-mode agent), and exposed population is microscopic — none of the conditions that would justify HIGH or CRITICAL apply.

Why not lower?

It is unauthenticated and network-reachable, which keeps it above LOW: any internet-exposed or weakly-segmented instance is a one-curl target. The bug also touches a physical-access platform, so even a Low-integrity tamper has reputational weight (audit-log manipulation around door events). MEDIUM, not LOW, is the floor.

1. Inventory first — confirm you actually run e-Face — For 95%+ of Western enterprises this CVE is non-applicable. Query your CMDB and physical-security asset list for Hanwang, e-Face, hw99, FACEID-FTX00 before spending another cycle. No mitigation SLA applies if the product isn't present — document and close.
2. Bind the management console to a dedicated physical-security VLAN, ACL it from everything else — If you do run e-Face, the management endpoint should be reachable only from the physical-security admin jump host. Restrict via firewall ACL or VRF separation. Because the reassessed verdict is MEDIUM, there is no noisgate mitigation SLA — fold this into routine network-segmentation hygiene within the 365-day remediation window.
3. Front the console with an authenticating reverse proxy — If business needs require broader reach, terminate at an nginx/HAProxy/IIS ARR fronting reverse proxy enforcing mTLS or SSO. This neutralizes the PR:N precondition entirely. Deploy as a hygiene item, not an emergency.
4. Enable and forward e-Face application audit logs to SIEM — Any successful exploitation will appear as an unauthenticated call to an admin path. Build a correlation rule for HTTP 200 responses on /admin/* and /api/* with no prior session-token issuance event.

Run on an auditor workstation (or any host with HTTP reach to the suspected e-Face console). Invoke as ./Check-EFace.ps1 -TargetHost 10.20.30.40 — no special privileges required; the script only fingerprints the HTTP banner and version string. Returns VULNERABLE / PATCHED / UNKNOWN.

#requires -Version 5.1
# noisgate verification — CVE-2026-13547 Hanwang e-Face GMP 6.3.5.4
param(
  [Parameter(Mandatory=$true)][string]$TargetHost,
  [int]$Port = 443,
  [switch]$Http
)

$ErrorActionPreference = 'SilentlyContinue'
$scheme = if ($Http) { 'http' } else { 'https' }
$base = "${scheme}://${TargetHost}:${Port}"

# Tolerate self-signed certs typical of on-prem appliances
if (-not $Http) {
  [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
  [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
}

function Get-Page($url) {
  try { (Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 8).Content } catch { $null }
}

$candidates = @('/', '/login', '/index.aspx', '/web/login.aspx', '/eface/')
$bodies = foreach ($p in $candidates) { Get-Page ($base + $p) }
$haystack = ($bodies -join "`n")

if (-not $haystack) {
  Write-Output 'UNKNOWN  - no HTTP response from target'
  exit 2
}

$isEface = $haystack -match '(?i)(e-?Face|Hanwang|hw99|汉王)'
if (-not $isEface) {
  Write-Output 'UNKNOWN  - product fingerprint not detected (likely not Hanwang e-Face)'
  exit 2
}

# Pull version token if exposed in banner / footer / meta
$ver = $null
$m = [regex]::Match($haystack, '(?i)(?:version|v|版本)[^0-9]{0,8}(\d+\.\d+\.\d+\.\d+)')
if ($m.Success) { $ver = $m.Groups[1].Value }

if ($ver) {
  Write-Output ("Detected Hanwang e-Face version: {0}" -f $ver)
  $parts = $ver.Split('.') | ForEach-Object { [int]$_ }
  # 6.3.5.4 and earlier in the 6.3.x train are presumed vulnerable until vendor confirms a fix
  if ($parts[0] -lt 6 -or ($parts[0] -eq 6 -and $parts[1] -lt 3) -or ($parts[0] -eq 6 -and $parts[1] -eq 3 -and ($parts[2] -lt 5 -or ($parts[2] -eq 5 -and $parts[3] -le 4)))) {
    Write-Output 'VULNERABLE'
    exit 1
  } else {
    Write-Output 'PATCHED'
    exit 0
  }
}

Write-Output 'UNKNOWN  - product detected but version banner not exposed; verify manually against vendor build number'
exit 2

Sources

1. GitHub Advisory Database (unreviewed)
2. CVE.org record
3. VulDB CVE index
4. CISA Known Exploited Vulnerabilities Catalog
5. MITRE CWE-284: Improper Access Control
6. FIRST CVSS 3.1 calculator
7. Hanwang Technology product portal
8. Hanwang FACEID terminal user manual reference