Vulnerability · Published Jul 20, 2022 · Assigned by twcert

CVE-2022-32959HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

Medium 6.8

In plain English

A medium-severity out-of-bounds write in HiCOS’ client-side citizen digital certificate from HINET. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for OS information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.

Affected products (as reported)

Vendor	Product	Versions
HINET	HiCOS’ client-side citizen digital certificate	unspecified – through 11 3.0.3.30306
HINET	HiCOS’ client-side citizen digital certificate	unspecified – through 11 3.1.0.00002
HINET	HiCOS’ client-side citizen digital certificate	unspecified – through 11 3.0.3.30404

Weakness: CWE-787 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-6290-738fe-1.html x_refsource_MISC