What is the CVSS score of CVE-2024-22388?

CVE-2024-22388 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Iclass Se Cp1000 Encoder Firmware CVE-2024-22388

HIGH

Initialization of a Resource with an Insecure Default (CWE-1188)

2024-02-06 ics-cert@hq.dhs.gov

Information Disclosure Iclass Se Cp1000 Encoder Firmware Iclass Se Readers Firmware Iclass Se Reader Modules Firmware Iclass Se Processors Firmware Omnikey 5427Ck Firmware Omnikey 5127Ck Firmware Omnikey 5023 Firmware Omnikey 5027 Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Feb 06, 2024 - 23:15 nvd

HIGH 7.8

DescriptionNVD

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.

AnalysisAI

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1188. Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys. Affected products include: Hidglobal Iclass Se Cp1000 Encoder Firmware, Hidglobal Iclass Se Readers Firmware, Hidglobal Iclass Se Reader Modules Firmware, Hidglobal Iclass Se Processors Firmware, Hidglobal Omnikey 5427Ck Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.