Description
During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device
References (1)
Core 1
Core References
Scores
CVSS v3
9.1
EPSS
0.0114
EPSS Percentile
62.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-121
CWE-787
Status
published
Products (8)
idemia/morphowave_compact_firmware
< 2.12.2
idemia/morphowave_sp_firmware
< 1.2.7
idemia/morphowave_xp_firmware
< 2.12.2
idemia/sigma_extreme_firmware
< 4.15.5
idemia/sigma_lite\+_firmware
< 4.15.5
idemia/sigma_lite_firmware
< 4.15.5
idemia/sigma_wide_firmware
< 4.15.5
idemia/visionpass_firmware
< 2.12.2
Published
Dec 15, 2023
Tracked Since
Feb 18, 2026