CVE-2024-23806

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23806
Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 Broken Link
https://www.hidglobal.com/support Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*
History

15 Feb 2024, 05:01

Type Values Removed Values Added
CPE cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*
cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*
References () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - Broken Link
References () https://www.hidglobal.com/support - () https://www.hidglobal.com/support - Product
Summary
  • (es) Se pueden extraer datos confidenciales de las tarjetas de configuración del lector HID iCLASS SE. Esto podría incluir claves de administrador de dispositivos y credenciales.
First Time Hidglobal
Hidglobal iclass Se Reader Configuration Cards Firmware
Hidglobal omnikey Secure Elements Reader Configuration Cards
Hidglobal iclass Se Reader Configuration Cards
Hidglobal omnikey Secure Elements Reader Configuration Cards Firmware

07 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-07 17:15

Updated : 2024-02-15 05:01

NVD link : CVE-2024-23806

Mitre link : CVE-2024-23806

CVE.ORG link : CVE-2024-23806

JSON object : View

Products Affected

hidglobal

  • iclass_se_reader_configuration_cards
  • omnikey_secure_elements_reader_configuration_cards_firmware
  • omnikey_secure_elements_reader_configuration_cards
  • iclass_se_reader_configuration_cards_firmware
CWE
CWE-287

Improper Authentication