Description
HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for OS information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-6290-738fe-1.html
Scores
CVSS v3
6.8
EPSS
0.0022
EPSS Percentile
12.5%
Attack Vector
PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (3)
hinet/hicos_natural_person_credential_component_client
3.0.3.30306
hinet/hicos_natural_person_credential_component_client
3.0.3.30404
hinet/hicos_natural_person_credential_component_client
3.1.0.00002
Published
Jul 20, 2022
Tracked Since
Feb 18, 2026