Vulnerability · Published Sep 16, 2024 · Assigned by Canon_EMEA
CVE-2024-1578Multiple MiCard PLUS card reader dropped characters
Medium 5.3
In plain English
A medium-severity security flaw in MiCard PLUS BLE from Rebranded by NT-ware (originally developed and provided by rf IDEAS). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration and might result in failed login attempts for end-users. Random characters being dropped from ID card numbers compromises the uniqueness of ID cards that can, therefore, result in a security issue if the users are using the ‘ID card self-registration’ function.
Affected products (as reported)
Weakness: CWE-1287 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
References
- https://ntware.atlassian.net/wiki/spaces/SA/pages/11973853216/2024+Security+Advisory+Multiple+MiCard+PLUS+card+reader+dropped+characters vendor-advisory, mitigation
- https://www.canon-europe.com/psirt/advisory-information vendor-advisory, mitigation