CVEvulnerability
CVE-2023-33222
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-12-15
- Last modified
- 2026-06-17
- Assigner
- a87f365f-9d39-4848-9b3a-58c7cae69cab
- CVSS 3.1 (a87f365f-9d39-4848-9b3a-58c7cae69cab)
- 6.8 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-121, CWE-787
Description
When handling contactless cards, usage of a specific function to get additional information from the card which doesn't
check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a
potential Remote Code Execution on the targeted device
Affected configurations
• idemia sigma lite firmware (< 4.15.5)
• idemia sigma lite\+ firmware (< 4.15.5)
• idemia sigma extreme firmware (< 4.15.5)
• idemia sigma wide firmware (< 4.15.5)
• idemia morphowave compact firmware (< 2.12.2)
• idemia morphowave xp firmware (< 2.12.2)
• idemia visionpass firmware (< 2.12.2)
• idemia morphowave sp firmware (< 1.2.7)