Description
When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code Execution on the targeted device. This is especially problematic if you use Default DESFire key.
References (1)
Core 1
Core References
Scores
CVSS v3
6.8
EPSS
0.0054
EPSS Percentile
67.8%
Attack Vector
PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-122
CWE-787
Status
published
Products (8)
idemia/morphowave_compact_firmware
< 2.12.2
idemia/morphowave_sp_firmware
< 1.2.7
idemia/morphowave_xp_firmware
< 2.12.2
idemia/sigma_extreme_firmware
< 4.15.5
idemia/sigma_lite\+_firmware
< 4.15.5
idemia/sigma_lite_firmware
< 4.15.5
idemia/sigma_wide_firmware
< 4.15.5
idemia/visionpass_firmware
< 2.12.2
Published
Dec 15, 2023
Tracked Since
Feb 18, 2026