CVE-2023-0248

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0248
An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 Third Party Advisory US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:johnsoncontrols:iosmart_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:johnsoncontrols:iosmart_gen_1:-:*:*:*:*:*:*:*
History

21 Dec 2023, 15:12

Type Values Removed Values Added
References () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - Third Party Advisory, US Government Resource
References () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - Vendor Advisory
CPE cpe:2.3:o:johnsoncontrols:iosmart_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:johnsoncontrols:iosmart_gen_1:-:*:*:*:*:*:*:*
First Time Johnsoncontrols iosmart Gen 1
Johnsoncontrols
Johnsoncontrols iosmart Gen 1 Firmware
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 5.3

15 Dec 2023, 22:15

Type Values Removed Values Added
Summary (en) An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.2 in certain circumstances can recover the reader's communication memory between the card and reader. (en) An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

15 Dec 2023, 21:15

Type Values Removed Values Added
Summary
  • (es) Un atacante con acceso físico al lector de tarjetas Kantech Gen1 ioSmart con versión de firmware anterior a 1.7.2 en determinadas circunstancias puede recuperar la memoria de comunicación del lector entre la tarjeta y el lector.
Summary (en) An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.7.2 in certain circumstances can recover the reader's communication memory between the card and reader. (en) An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.2 in certain circumstances can recover the reader's communication memory between the card and reader.

14 Dec 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-14 21:15

Updated : 2023-12-21 15:12

NVD link : CVE-2023-0248

Mitre link : CVE-2023-0248

CVE.ORG link : CVE-2023-0248

JSON object : View

Products Affected

johnsoncontrols

  • iosmart_gen_1_firmware
  • iosmart_gen_1
CWE
CWE-401

Missing Release of Memory after Effective Lifetime

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor