CVE-2024-23806

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23806
Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02
https://www.hidglobal.com/support Product
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02
https://www.hidglobal.com/support Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:58

Type Values Removed Values Added
References
  • () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 -
References () https://www.hidglobal.com/support - Product () https://www.hidglobal.com/support - Product

11 Oct 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02', 'tags': ['Broken Link'], 'source': 'ics-cert@hq.dhs.gov'}
  • () https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 -
Summary (en) Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. (en) Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.
CWE CWE-285

15 Feb 2024, 05:01

Type Values Removed Values Added
References () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - () https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - Broken Link
References () https://www.hidglobal.com/support - () https://www.hidglobal.com/support - Product
CPE cpe:2.3:h:hidglobal:omnikey_secure_elements_reader_configuration_cards:-:*:*:*:*:*:*:*
cpe:2.3:h:hidglobal:iclass_se_reader_configuration_cards:-:*:*:*:*:*:*:*
cpe:2.3:o:hidglobal:omnikey_secure_elements_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:hidglobal:iclass_se_reader_configuration_cards_firmware:-:*:*:*:*:*:*:*
First Time Hidglobal
Hidglobal omnikey Secure Elements Reader Configuration Cards Firmware
Hidglobal omnikey Secure Elements Reader Configuration Cards
Hidglobal iclass Se Reader Configuration Cards Firmware
Hidglobal iclass Se Reader Configuration Cards

07 Feb 2024, 17:38

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-07 17:15

Updated : 2024-11-21 08:58

NVD link : CVE-2024-23806

Mitre link : CVE-2024-23806

CVE.ORG link : CVE-2024-23806

JSON object : View

Products Affected

hidglobal

  • omnikey_secure_elements_reader_configuration_cards
  • iclass_se_reader_configuration_cards_firmware
  • iclass_se_reader_configuration_cards
  • omnikey_secure_elements_reader_configuration_cards_firmware
CWE
CWE-285

Improper Authorization

CWE-287

Improper Authentication