Lucene search

IcscertCVE-2024-23806

HistoryFeb 07, 2024 - 5:15 p.m.

CVE-2024-23806

2024-02-0717:15:10

CWE-287

icscert

web.nvd.nist.gov

cve-2024-23806

nvd

sensitive data

hid iclass se

reader configuration cards

credential keys

device administrator keys

CVSS3

5.3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

Affected configurations

Nvd

Node

hidglobalomnikey_secure_elements_reader_configuration_cards_firmwareMatch-

AND

hidglobalomnikey_secure_elements_reader_configuration_cardsMatch-

Node

hidglobaliclass_se_reader_configuration_cards_firmwareMatch-

AND

hidglobaliclass_se_reader_configuration_cardsMatch-

VendorProductVersionCPE
hidglobalomnikey_secure_elements_reader_configuration_cards_firmware-cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
hidglobalomnikey_secure_elements_reader_configuration_cards-cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*
hidglobaliclass_se_reader_configuration_cards_firmware-cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
hidglobaliclass_se_reader_configuration_cards-cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hidglobal	omnikey_secure_elements_reader_configuration_cards_firmware	-	cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:::::::*
hidglobal	omnikey_secure_elements_reader_configuration_cards	-	cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:::::::*
hidglobal	iclass_se_reader_configuration_cards_firmware	-	cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:::::::*
hidglobal	iclass_se_reader_configuration_cards	-	cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HID iCLASS SE reader configuration cards",
    "vendor": "HID Global",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "OMNIKEY Secure Elements reader configuration cards",
    "vendor": "HID Global",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  }
]

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02

www.hidglobal.com/support

CVSS3

5.3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

Related for CVE-2024-23806