An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.
References
| Link | Resource |
|---|---|
| https://www.johnsoncontrols.com/cyber-solutions/security-advisories | Vendor Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Dec 2023, 15:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:johnsoncontrols:iosmart_gen_1_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:johnsoncontrols:iosmart_gen_1:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | CWE-401 | |
| First Time |
Johnsoncontrols
Johnsoncontrols iosmart Gen 1 Johnsoncontrols iosmart Gen 1 Firmware |
|
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 - Third Party Advisory, US Government Resource | |
| References | () https://www.johnsoncontrols.com/cyber-solutions/security-advisories - Vendor Advisory |
15 Dec 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader. |
14 Dec 2023, 22:44
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-14 21:15
Updated : 2023-12-21 15:12
NVD link : CVE-2023-0248
Mitre link : CVE-2023-0248
JSON object : View
Products Affected
johnsoncontrols
- iosmart_gen_1
- iosmart_gen_1_firmware
CWE
CWE-401
Missing Release of Memory after Effective Lifetime