CVE-2023-0248

Kantech Gen1 ioSmart card reader

State: Published
Severity: 7.5 High
Published: Dec 14, 2023
Updated: Oct 8, 2024
Reserved: Jan 12, 2023

Description

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L	jci

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
ioSmart Gen1Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.	before 1.07.02Affected

References

https://www.johnsoncontrols.com/cyber-solutions/security-advisories
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.