CVE-2023-0248

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0248
An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.3

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 Third Party Advisory US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 Third Party Advisory US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:johnsoncontrols:iosmart_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:johnsoncontrols:iosmart_gen_1:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 7.5
References () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - Third Party Advisory, US Government Resource () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - Third Party Advisory, US Government Resource
References () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - Vendor Advisory () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - Vendor Advisory

21 Dec 2023, 15:12

Type Values Removed Values Added
References () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - Third Party Advisory, US Government Resource
References () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
First Time Johnsoncontrols
Johnsoncontrols iosmart Gen 1
Johnsoncontrols iosmart Gen 1 Firmware
CPE cpe:2.3:o:johnsoncontrols:iosmart_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:johnsoncontrols:iosmart_gen_1:-:*:*:*:*:*:*:*
CWE CWE-401

15 Dec 2023, 22:15

Type Values Removed Values Added
Summary An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.7.2 in certain circumstances can recover the reader's communication memory between the card and reader. An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

14 Dec 2023, 22:44

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-14 21:15

Updated : 2024-11-21 07:36

NVD link : CVE-2023-0248

Mitre link : CVE-2023-0248

CVE.ORG link : CVE-2023-0248

JSON object : View

Products Affected

johnsoncontrols

  • iosmart_gen_1_firmware
  • iosmart_gen_1
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-401

Missing Release of Memory after Effective Lifetime