CVE-2023-33222

MEDIUM

Idemia MorphoWave and Sigma Firmware - Stack-based Buffer Overflow

Title source: llm

Description

When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device

References (1)

Core 1

Core References

Vendor Advisory

https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf

Scores

CVSS v3 6.8

EPSS 0.0129

EPSS Percentile 66.6%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-121 CWE-787

Status published

Products (8)

idemia/morphowave_compact_firmware < 2.12.2

idemia/morphowave_sp_firmware < 1.2.7

idemia/morphowave_xp_firmware < 2.12.2

idemia/sigma_extreme_firmware < 4.15.5

idemia/sigma_lite\+_firmware < 4.15.5

idemia/sigma_lite_firmware < 4.15.5

idemia/sigma_wide_firmware < 4.15.5

idemia/visionpass_firmware < 2.12.2

Published Dec 15, 2023

Tracked Since Feb 18, 2026