Vulnerability · Published Dec 15, 2023 · Assigned by IDEMIA
CVE-2023-33221 Heap Buffer Overflow when reading DESFire card
Medium 6.8
In plain English
A medium-severity heap buffer overflow in MorphoWave Compact/XP from IDEMIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code Execution on the targeted device. This is especially problematic if you use Default DESFire key.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IDEMIA | SIGMA Lite & Lite + | 0 – before 4.15.5 |
| IDEMIA | SIGMA Wide | 0 – before 4.15.5 |
| IDEMIA | SIGMA Extreme | 0 – before 4.15.5 |
| IDEMIA | MorphoWave Compact/XP | 0 – before 2.12.2 |
| IDEMIA | VisionPass | 0 – before 2.12.2 |
| IDEMIA | MorphoWave SP | 0 – before 1.2.7 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H