HP Card Readers CVE-2025-11998

Exploitation requires physical proximity to one of the specific affected models (HP Card Readers B Models X3D03B & Y7C05B) and an active card swipe event during which an NFC device (smartphone or smartwatch) is in proximity to the reader. The identity inheritance occurs 'under certain conditions,' meaning it is timing- and proximity-dependent rather than reliably triggerable. Limiting factors that reduce real-world risk: physical access to the reader is mandatory (AV:P), user interaction via a card swipe is required (UI:A), the NFC device must be present at the moment of the swipe, and only the two named hardware models are affected - remote, network, or scaled exploitation is not possible.

This is a genuine but comparatively low-urgency issue whose signals align rather than conflict. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:A) confirms the attack requires PHYSICAL proximity to the card reader and active user interaction (a card swipe event), which is the single largest limiting factor - it cannot be exploited remotely or at scale. EPSS is very low (0.18%, 7th percentile), consistent with a physical-only vulnerability that is impractical to exploit en masse. The issue is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. Although the vector rates confidentiality and integrity impact as High (VC:H/VI:H) - reflecting that a prior user's identity can be inherited - the physical-access and timing prerequisites keep real-world risk moderate. Note the vendor-supplied vector sets VI:H (integrity), which is defensible if inherited identity permits acting as another user, but the CWE-200 (Information Disclosure) classification and the description's framing emphasize confidentiality; this integrity rating should be verified against HP's advisory. Bottom line: a legitimate medium-severity (6.8) physical/local flaw affecting specific hardware, not a widespread-exploitation priority.

An attacker (or an unwitting user) with physical access to an affected HP card reader positions an NFC-capable device such as a smartphone or smartwatch near the reader at the moment a card is swiped, causing the reader to inherit the identity of the previous user and granting access or disclosing that prior identity. No public exploit code is referenced; exploitation requires physical presence and precise timing during a swipe event.