github - ghsa-whv2-8g4p-xpx6

ghsa-whv2-8g4p-xpx6

Vulnerability from github

Published

2024-02-07 18:30

Modified

2024-10-11 18:32

Severity ?

5.3 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Details

Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-23806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-07T17:15:10Z",
    "severity": "MODERATE"
  },
  "details": "\n\n\nSensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.\n\n\n\n",
  "id": "GHSA-whv2-8g4p-xpx6",
  "modified": "2024-10-11T18:32:47Z",
  "published": "2024-02-07T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23806"
    },
    {
      "type": "WEB",
      "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02"
    },
    {
      "type": "WEB",
      "url": "https://www.hidglobal.com/support"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-23806

Vulnerability from cvelistv5

Published

2024-02-07 16:23

Modified

2024-10-11 15:41

Severity ?

5.3 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

HID Global Reader Configuration Cards Improper Authorization

References

▼	URL	Tags
	https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02
	https://www.hidglobal.com/support

Impacted products

▼	Vendor	Product
	HID Global	HID iCLASS SE reader configuration cards
	HID Global	OMNIKEY Secure Elements reader configuration cards

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:13:08.449Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.hidglobal.com/support"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HID iCLASS SE reader configuration cards",
          "vendor": "HID Global",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "OMNIKEY Secure Elements reader configuration cards",
          "vendor": "HID Global",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "HID Global reported this vulnerability to CISA."
        }
      ],
      "datePublic": "2024-02-06T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-11T15:41:29.953Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02"
        },
        {
          "url": "https://www.hidglobal.com/support"
        }
      ],
      "source": {
        "advisory": "ICSA-24-037-02",
        "discovery": "INTERNAL"
      },
      "title": "HID Global Reader Configuration Cards Improper Authorization",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHID Global recommends the following mitigations to reduce the risk:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eElite Key and Custom Key customers that have kept their configuration cards secure should continue to be vigilant and restrict access to those cards. To exploit this vulnerability, a reader must be physically close to or in possession of the configuration cards to communicate with the card and extract information.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eAdministrators should plan to securely destroy unneeded configuration cards.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eCustomers using the HID standard key, and other customers who are concerned their keys may be compromised should consider steps to update the readers and credentials with new keys. To assist in this effort, HID will be introducing a free upgrade to the Elite Key program. Contact your HID representative for more information at \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.hidglobal.com/support\"\u003ehttps://www.hidglobal.com/support\u003c/a\u003e.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eHID has also provided additional steps users can take steps to harden their readers to prevent malicious configuration changes.\u003c/p\u003e\u003cp\u003eiCLASS SE Readers\u003c/p\u003e\u003cul\u003e\u003cli\u003eiCLASS SE Readers using firmware version 8.6.0.4 or higher can use the HID Reader Manager application to prevent the readers from accepting configuration changes from Configuration Cards.\u003cbr\u003eIf you need assistance, or if the reader firmware has not been updated to 8.6.0.4 or higher, contact HID Technical Support.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eHID OMNIKEY Readers, OMNIKEY Secure Elements, iCLASS SE Reader Modules, iCLASS SE Processors\u003c/p\u003e\u003cul\u003e\u003cli\u003eContact HID to receive a \"Shield Card\" that will prevent further configuration changes using reader configuration cards.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "HID Global recommends the following mitigations to reduce the risk:\n\n  *  Elite Key and Custom Key customers that have kept their configuration cards secure should continue to be vigilant and restrict access to those cards. To exploit this vulnerability, a reader must be physically close to or in possession of the configuration cards to communicate with the card and extract information.\n\n\n  *  Administrators should plan to securely destroy unneeded configuration cards.\n\n\n  *  Customers using the HID standard key, and other customers who are concerned their keys may be compromised should consider steps to update the readers and credentials with new keys. To assist in this effort, HID will be introducing a free upgrade to the Elite Key program. Contact your HID representative for more information at  https://www.hidglobal.com/support .\n\n\n\n\nHID has also provided additional steps users can take steps to harden their readers to prevent malicious configuration changes.\n\niCLASS SE Readers\n\n  *  iCLASS SE Readers using firmware version 8.6.0.4 or higher can use the HID Reader Manager application to prevent the readers from accepting configuration changes from Configuration Cards.\nIf you need assistance, or if the reader firmware has not been updated to 8.6.0.4 or higher, contact HID Technical Support.\n\n\nHID OMNIKEY Readers, OMNIKEY Secure Elements, iCLASS SE Reader Modules, iCLASS SE Processors\n\n  *  Contact HID to receive a \"Shield Card\" that will prevent further configuration changes using reader configuration cards."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2024-23806",
    "datePublished": "2024-02-07T16:23:16.889Z",
    "dateReserved": "2024-01-25T17:05:42.439Z",
    "dateUpdated": "2024-10-11T15:41:29.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted