High severity · published Dec 15, 2023
CVE-2023-33217
By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent
denial of service for the terminal. the only way to recover the terminal is by sending back the terminal to the manufacturer
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Morphowave Compact Firmware · Idemia
before 2.12.2 · source: NVD
MS
Morphowave SP Firmware · Idemia
before 1.2.7 · source: NVD
MX
Morphowave XP Firmware · Idemia
before 2.12.2 · source: NVD
SE
Sigma Extreme Firmware · Idemia
before 4.15.5 · source: NVD
SL
Sigma Lite Firmware · Idemia
before 4.15.5 · source: NVD
SL
Sigma Lite+ Firmware · Idemia
before 4.15.5 · source: NVD
SW
Sigma Wide Firmware · Idemia
before 4.15.5 · source: NVD
VF
Visionpass Firmware · Idemia
before 2.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33217
Vendor Advisory
https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf
More from Morphowave Compact Firmware
9.8
CVE-2023-33222
When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading
9.8
CVE-2023-33221
When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received
9.8
CVE-2023-33220
During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check
9.8
CVE-2023-33219
The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations
9.8
CVE-2023-33218
The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow