Vulnerability · Published Feb 6, 2024 · Assigned by icscert
CVE-2024-22388Insecure Default Initialization of Resource in HID Global
Medium 5.9
In plain English
A medium-severity security flaw in iCLASS SE CP1000 Encoder from HID Global. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 93.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HID Global | iCLASS SE CP1000 Encoder | All |
| HID Global | iCLASS SE Readers | All |
| HID Global | iCLASS SE Reader Modules | All |
| HID Global | iCLASS SE Processors | All |
| HID Global | OMNIKEY 5427CK Readers | All |
| HID Global | OMNIKEY 5127CK Readers | All |
| HID Global | OMNIKEY 5023 Readers | All |
| HID Global | OMNIKEY 5027 Readers | All |
Weakness: CWE-1188 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N