CasfID NFC Wristbands EUVD-2026-49765

Q: What is the CVSS score of EUVD-2026-49765?

EUVD-2026-49765 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-4648 MEDIUM

Inadequate Encryption Strength (CWE-326)

2026-07-28 INCIBE

GHSA-4x9m-p82w-8mmp

Information Disclosure Nfc Wristbands

6.8

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Physical access (AV:P) required; low complexity (AC:L); no privileges (PR:N); high confidentiality and integrity impact.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 12:18 vuln.today

CVE Published

Jul 28, 2026 - 11:41 cve.org

MEDIUM 6.8

DescriptionCVE.org

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fest 2025), which employs cards based on MIFARE Classic technology (FM11RF08S). The cryptographic weakness of the authentication algorithm allows an attacker to retrieve access keys using techniques known as Backdoored Nested Attack, read the wristband’s entire contents, and clone its credentials onto a compatible rewritable card. Exploitation of this vulnerability could enable the impersonation of other attendees, the fraudulent use of the balance associated with their wristbands, and financial losses for both the affected users and the event organizers.

AnalysisAI

Weak cryptography in CasfID NFC wristbands allows attackers with physical access to clone credentials and impersonate attendees. The wristbands use MIFARE Classic technology (FM11RF08S) vulnerable to the Backdoored Nested Attack, enabling full readout and cloning of wallet data. No active exploitation is confirmed, but the attack technique is well-documented and can lead to financial fraud at events.

Technical ContextAI

The vulnerability stems from insecure cryptographic algorithm usage (CWE-326) in MIFARE Classic cards, specifically the FM11RF08S chip. MIFARE Classic employs the proprietary Crypto-1 cipher, which has known weaknesses allowing key recovery through side-channel or nested attacks. The CPE cpe:2.3:a:casfid_servicios_tecnológicos:nfc_wristbands:*:*:*:*:*:*:*:* confirms the affected product is the CasfID NFC wristband system. The attack exploits the lack of strong mutual authentication, enabling an attacker to read and clone the wristband's contents without authentication.

RemediationAI

No vendor-released patch identified at time of analysis, as the vulnerability is inherent to the MIFARE Classic hardware. Event organizers should replace wristbands with secure alternatives (e.g., MIFARE DESFire or AES-128 encrypted NFC tags). Compensating controls include implementing backend transaction limits, real-time anomaly detection for balance changes, and requiring PIN or additional authentication for high-value transactions. Note that hardware replacement is the only definitive fix, as software patches cannot change the cryptographic core of the cards.