CVE-2024-23806

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23806
Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02
https://www.hidglobal.com/support Product
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02
https://www.hidglobal.com/support Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:58

Type Values Removed Values Added
References
  • () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 -
References () https://www.hidglobal.com/support - Product () https://www.hidglobal.com/support - Product

11 Oct 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02', 'tags': ['Broken Link'], 'source': 'ics-cert@hq.dhs.gov'}
  • () https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 -
CWE CWE-285
Summary (en) Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. (en) Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

15 Feb 2024, 05:01

Type Values Removed Values Added
First Time Hidglobal omnikey Secure Elements Reader Configuration Cards
Hidglobal omnikey Secure Elements Reader Configuration Cards Firmware
Hidglobal
Hidglobal iclass Se Reader Configuration Cards
Hidglobal iclass Se Reader Configuration Cards Firmware
CPE cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*
cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*
References () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - Broken Link
References () https://www.hidglobal.com/support - () https://www.hidglobal.com/support - Product
Summary
  • (es) Se pueden extraer datos confidenciales de las tarjetas de configuración del lector HID iCLASS SE. Esto podría incluir claves de administrador de dispositivos y credenciales.

07 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-07 17:15

Updated : 2024-11-21 08:58

NVD link : CVE-2024-23806

Mitre link : CVE-2024-23806

CVE.ORG link : CVE-2024-23806

JSON object : View

Products Affected

hidglobal

  • iclass_se_reader_configuration_cards_firmware
  • iclass_se_reader_configuration_cards
  • omnikey_secure_elements_reader_configuration_cards_firmware
  • omnikey_secure_elements_reader_configuration_cards
CWE
CWE-285

Improper Authorization

CWE-287

Improper Authentication