PT-2021-20348 · Nxp · Ntag+1

Christian Herrmann + 2 · Published 2021-06-06 · Updated 2021-06-17 · CVE-2021-33881

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: NXP MIFARE Ultralight and NTAG cards (affected versions not specified)

Description: The issue allows an attacker to interrupt a write operation, also known as a "tear off" attack, over RFID. This can bypass a Monotonic Counter protection mechanism. The impact of this issue depends on how the anti-tear-off feature is used in specific applications, such as public transportation or physical access control.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-33881

Affected Products

Ntag

Nxp Mifare Ultralight

References · 6

• 🔥 https://sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33881 · Security Note
• https://nxp.com/docs/en/application-note/AN11340.pdf · Vendor Advisory
• https://nxp.com/docs/en/application-note/AN13089.pdf · Vendor Advisory
• https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html · Note
• https://t.me/cvenotify/15658 · Telegram Post