Felica Ic Chips
Monthly
Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.
Data disclosure and tampering in Sony FeliCa IC chips manufactured in or before 2017 stems from a missing cryptographic step (CWE-325) in the chip's contactless security handling. An attacker with physical/NFC proximity to an affected card or device can read or alter data stored on the chip, undermining the confidentiality and integrity of stored credentials, balances, or identity data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High), driven entirely by high impact under a physical attack vector.