Micard Plus Ci Firmware CVE-2024-1578

Q: What is the CVSS score of CVE-2024-1578?

CVE-2024-1578 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Improper Validation of Specified Type of Input (CWE-1287)

2024-09-16 4586e0a2-224d-4f8a-9cb4-8882b208c0b3

Information Disclosure Micard Plus Ci Firmware Micard Plus Ble Firmware

5.3

CVSS 4.0 · Vendor: 4586e0a2-224d-4f8a-9cb4-8882b208c0b3

Severity by source

Vendor (4586e0a2-224d-4f8a-9cb4-8882b208c0b3) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (4586e0a2-224d-4f8a-9cb4-8882b208c0b3) · only source for this CVE.

CVSS VectorVendor: 4586e0a2-224d-4f8a-9cb4-8882b208c0b3

CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Sep 16, 2024 - 07:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration and might result in failed login attempts for end-users. Random characters being dropped from ID card numbers compromises the uniqueness of ID cards that can, therefore, result in a security issue if the users are using the ‘ID card self-registration’ function.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-1287. The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration and might result in failed login attempts for end-users. Random characters being dropped from ID card numbers compromises the uniqueness of ID cards that can, therefore, result in a security issue if the users are using the ‘ID card self-registration’ function. Affected products include: Rfideas Micard Plus Ci Firmware, Rfideas Micard Plus Ble Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.