Lucene search

IcscertVULNRICHMENT:CVE-2024-22388

HistoryFeb 06, 2024 - 11:06 p.m.

CVE-2024-22388 HID Global Encoders Improper Authorization

2024-02-0623:06:07

CWE-285

icscert

github.com

cve-2024-22388

hid global

encoders

improper authorization

communication channel

sensitive data

reader configuration cards

credential

device administration keys

CVSS3

5.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.

References

support.hidglobal.com/

www.cisa.gov/news-events/ics-advisories/icsa-24-037-01

CVSS3

5.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-22388