CVE-2022-32961

MEDIUM

HICOS Natural Person Credential Component Client - Stack-based Buffer Overflow via IC Card Token Length

Title source: llm
STIX 2.1

Description

HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-6292-fb267-1.html

Scores

CVSS v3 6.8
EPSS 0.0022
EPSS Percentile 12.5%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (3)
hinet/hicos_natural_person_credential_component_client 3.0.3.30306
hinet/hicos_natural_person_credential_component_client 3.0.3.30404
hinet/hicos_natural_person_credential_component_client 3.1.0.00002
Published Jul 20, 2022
Tracked Since Feb 18, 2026