EUVD-2026-46148
GHSA-4jgm-gw57-4jwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain NFC-range access to card
-
DeliveryQuery chip with rogue reader
-
ExploitBypass missing cryptographic step
-
ExecutionRead or overwrite stored data
-
ImpactUse altered/exfiltrated data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic step completeness
|
| Exploitation Conditions | Exploitation requires physical/NFC proximity to the specific affected chip (CVSS AV:P) - the attacker must bring a reader within contactless range of a FeliCa IC chip that was shipped in or before 2017; chips shipped after 2017 are not affected, which is the primary limiting factor. No authentication, privileges, or user interaction are otherwise needed (PR:N/UI:N), and attack complexity is low (AC:L), so against an in-range vulnerable chip the read/tamper is reliable. The hard limits on realistic risk are: (1) per-device physical access, precluding remote or mass exploitation, and (2) the ship-date scoping, so only legacy inventory is at risk. |
| Impact | The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 7.0 High: impact to confidentiality, integrity, and availability of the stored data is High, but exploitation requires a Physical attack vector (AV:P), meaning the attacker must have the card/device physically present within NFC range. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or widespread exploitation - the risk is bounded by the need for physical proximity to each target chip, making this better suited to targeted, per-card attacks than mass exploitation. The absence of AT (attack requirements) and low complexity (AC:L) mean that against a chip in hand the attack is reliable, but the physical constraint and the hardware nature of the flaw (no software patch possible) shape it as a per-device rather than fleet-wide risk. Note: CVSS 4.0 was supplied but no CVSS 3.1 vector; the 7.0 reflects high data impact tempered by physical access, not remote exploitability. |
| Exploit ScenarioDerived | An attacker gains brief physical possession of, or NFC-range proximity to, a victim's pre-2017 FeliCa card or FeliCa-equipped device - for example a transit or stored-value card left unattended - and uses a rogue NFC reader to exploit the missing cryptographic step, reading protected data or writing altered values (such as a balance or access flag) back to the chip. Because no public exploit is documented, this presumes a capable attacker with custom NFC tooling and knowledge of the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 21, 2026
Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.
Earlier versions of this analysis (1)
Physical proximity exploitation of Sony FeliCa IC chips manufactured in or before 2017 enables an attacker to read or tamper with data stored on the chip due to an incomplete cryptographic step in the chip's security protocol. The vulnerability (CWE-325) reflects a missing cryptographic operation - such as an integrity check, authentication handshake, or encryption step - that should protect on-chip data from unauthorized access or modification. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the physical attack vector makes this a targeted risk for high-value card holders in transit, payment, and access control deployments.
RemediationAI
No software patch is applicable because the defect is in shipped IC hardware; No vendor-released patch version was identified at time of analysis. The primary remediation is to migrate to or reissue FeliCa chips manufactured after 2017 that do not contain the missing cryptographic step - i.e., replace affected cards, devices, or embedded modules through the normal card-reissuance lifecycle. As compensating controls where replacement is not immediate: limit the value or sensitivity of data stored directly on legacy chips (favor server-side balance/credential validation over on-card trust so a tampered chip is rejected at the reader), monitor for anomalous transactions indicative of cloned or altered cards, and physically protect high-value cards from prolonged unattended access to hostile readers. Consult Sony's advisory (https://www.sony.co.jp/en/Products/felica/business/information/2025001.html) and the JVN coordination note (https://jvn.jp/en/jp/JVN40509781/) for vendor-specific guidance and any successor chip designations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FeliCa is Sony's proprietary contactless (13.56 MHz NFC-F) smart-card technology widely used for transit ticketing, stored-value payment, and access control, especially across Japan and parts of Asia. The affected component is the FeliCa IC chip hardware itself (cpe:2.3:a:sony_corporation:felica_ic_chips), specifically silicon shipped in or before 2017. The root cause is CWE-325 (Missing Required Cryptographic Step): the chip's security protocol omits a step in its cryptographic sequence, weakening the mutual authentication/encryption that is supposed to protect on-card data during contactless transactions. When a required cryptographic operation is skipped, the assurance that data reads and writes are performed only by legitimate, authenticated readers is broken, enabling unauthorized read or modification of stored data.
Know when Felica Ic Chips gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Physical NFC proximity to the chip is required (AV:P) with no auth or interaction (PR:N/UI:N); missing crypto step yields full read/tamper of stored data (C/I/A:H).
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with.
Executive ViewAI
Organizations using Sony FeliCa IC chips manufactured through 2017 face credential compromise risk where attackers with physical/NFC proximity can read or alter stored payment credentials, transit passes, or identity data. While no public exploit has been identified to date, affected organizations must inventory vulnerable devices and develop replacement strategies as no patch is available and the vulnerability undermines the security of payment systems and access control networks.
No vendor-released patch identified at time of analysis. Interim mitigations include: physical security controls around contactless reader deployment; disabling NFC functionality on vulnerable devices where operationally feasible; restricting physical proximity access to systems; implementing secondary authentication mechanisms where possible; and accelerated replacement planning for affected chips.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB