CVE-2023-33220

Published: Dic 15, 2023 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2023-37390 Aliases: GSD-2023-33220
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,1
Source: a87f365f-9d39-4848-9b3a-58c7cae69cab
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none

Description

AI Translation Available

During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes
to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted
device

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0086
Percentile
0,7th
Updated

EPSS Score Trend (Last 90 Days)

121

Stack-based Buffer Overflow

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control Other
Potential Impacts:
Modify Memory Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Execute Unauthorized Code Or Commands Bypass Protection Mechanism Other
Applicable Platforms
Languages: C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
787

Out-of-bounds Write

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
Operating System

Visionpass Firmware by Idemia

Product Information
Vendor Idemia
Product Visionpass Firmware
Version Range Affected
To 2.12.2 (exclusive)
cpe:2.3:o:idemia:visionpass_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Sigma Extreme Firmware by Idemia

Product Information
Vendor Idemia
Product Sigma Extreme Firmware
Version Range Affected
To 4.15.5 (exclusive)
cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Morphowave Compact Firmware by Idemia

Product Information
Vendor Idemia
Product Morphowave Compact Firmware
Version Range Affected
To 2.12.2 (exclusive)
cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Sigma Wide Firmware by Idemia

Product Information
Vendor Idemia
Product Sigma Wide Firmware
Version Range Affected
To 4.15.5 (exclusive)
cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Sigma Lite Firmware by Idemia

Product Information
Vendor Idemia
Product Sigma Lite Firmware
Version Range Affected
To 4.15.5 (exclusive)
cpe:2.3:o:idemia:sigma_lite_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Sigma Lite\+ Firmware by Idemia

Product Information
Vendor Idemia
Product Sigma Lite\+ Firmware
Version Range Affected
To 4.15.5 (exclusive)
cpe:2.3:o:idemia:sigma_lite\+_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Morphowave Xp Firmware by Idemia

Product Information
Vendor Idemia
Product Morphowave Xp Firmware
Version Range Affected
To 2.12.2 (exclusive)
cpe:2.3:o:idemia:morphowave_xp_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Morphowave Sp Firmware by Idemia

Product Information
Vendor Idemia
Product Morphowave Sp Firmware
Version Range Affected
To 1.2.7 (exclusive)
cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.idemia.com/wp-content/uploads/2023/11/Security-…
Vendor Advisory
https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-…
https://www.idemia.com/wp-content/uploads/2023/11/Security-…
Vendor Advisory
https://www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-…