Which versions of FeliCa IC Chips are affected by CVE-2026-59776?

Organizations using Sony FeliCa IC chips manufactured through 2017 face credential compromise risk where attackers with physical/NFC proximity can read or alter stored payment credentials, transit…

How to fix or mitigate CVE-2026-59776?

Within 24 hours, audit all systems and devices using Sony FeliCa IC chips to identify affected inventory, particularly payment terminals, transit fare systems, and physical access control readers deployed before 2018. Within 7 days, implement compensating controls including physical security hardening around contactless readers, disabling NFC functionality where operationally feasible, and restricting device access to authorized personnel only. Within 30 days, develop and begin executing a phased replacement program for affected FeliCa chips with newer-generation secure chips, establish vendor relationships for replacement hardware, and communicate mitigation timeline to affected users and business partners.

FeliCa IC Chips CVE-2026-59776

Q: What is the CVSS score of CVE-2026-59776?

CVE-2026-59776 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-46148 HIGH

Missing Cryptographic Step (CWE-325)

2026-07-21 jpcert

GHSA-4jgm-gw57-4jwf

Information Disclosure Felica Ic Chips

7.0

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

7.0 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Physical NFC proximity to the chip is required (AV:P) with no auth or interaction (PR:N/UI:N); missing crypto step yields full read/tamper of stored data (C/I/A:H).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 04:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 04:22 vuln.today

cvss_changed

Severity Changed

Jul 21, 2026 - 04:22 NVD

MEDIUM HIGH

CVSS changed

Jul 21, 2026 - 04:22 NVD

6.8 (MEDIUM) 7.0 (HIGH)

Analysis Generated

Jul 21, 2026 - 03:45 vuln.today

DescriptionCVE.org

Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with.

AnalysisAI

Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.

Technical ContextAI

FeliCa is Sony's proprietary contactless (13.56 MHz NFC-F) smart-card technology widely used for transit ticketing, stored-value payment, and access control, especially across Japan and parts of Asia. The affected component is the FeliCa IC chip hardware itself (cpe:2.3:a:sony_corporation:felica_ic_chips), specifically silicon shipped in or before 2017. The root cause is CWE-325 (Missing Required Cryptographic Step): the chip's security protocol omits a step in its cryptographic sequence, weakening the mutual authentication/encryption that is supposed to protect on-card data during contactless transactions. When a required cryptographic operation is skipped, the assurance that data reads and writes are performed only by legitimate, authenticated readers is broken, enabling unauthorized read or modification of stored data.

RemediationAI

No software patch is applicable because the defect is in shipped IC hardware; No vendor-released patch version was identified at time of analysis. The primary remediation is to migrate to or reissue FeliCa chips manufactured after 2017 that do not contain the missing cryptographic step - i.e., replace affected cards, devices, or embedded modules through the normal card-reissuance lifecycle. As compensating controls where replacement is not immediate: limit the value or sensitivity of data stored directly on legacy chips (favor server-side balance/credential validation over on-card trust so a tampered chip is rejected at the reader), monitor for anomalous transactions indicative of cloned or altered cards, and physically protect high-value cards from prolonged unattended access to hostile readers. Consult Sony's advisory (https://www.sony.co.jp/en/Products/felica/business/information/2025001.html) and the JVN coordination note (https://jvn.jp/en/jp/JVN40509781/) for vendor-specific guidance and any successor chip designations.