CVE-2023-33222: When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received…

PriorityP258critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.29%

66.6th percentile

When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device

Affected

14 ranges

Vendor	Product	Version range	Fixed in
idemia	morphowave_compact_firmware	< 2.12.2	2.12.2
idemia	morphowave_compact_xp	< 2.12.2	2.12.2
idemia	morphowave_sp	< 1.2.7	1.2.7
idemia	morphowave_sp_firmware	< 1.2.7	1.2.7
idemia	morphowave_xp_firmware	< 2.12.2	2.12.2
idemia	sigma_extreme	< 4.15.5	4.15.5
idemia	sigma_extreme_firmware	< 4.15.5	4.15.5
idemia	sigma_lite_+_firmware	< 4.15.5	4.15.5
idemia	sigma_lite_firmware	< 4.15.5	4.15.5
idemia	sigma_lite_lite	< 4.15.5	4.15.5
idemia	sigma_wide	< 4.15.5	4.15.5
idemia	sigma_wide_firmware	< 4.15.5	4.15.5
idemia	visionpass	< 2.12.2	2.12.2
idemia	visionpass_firmware	< 2.12.2	2.12.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.