PT-2023-16111 · Kantech · Kantech Gen1 Iosmart Card Reader

Colin Oflynn · Published 2023-12-14 · Updated 2023-12-21 · CVE-2023-0248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Kantech Gen1 ioSmart card reader versions prior to 1.07.02

Description An attacker with physical access to the Kantech Gen1 ioSmart card reader in certain circumstances can recover the reader's communication memory between the card and reader.

Recommendations For versions prior to 1.07.02, update the firmware to version 1.07.02 or later to resolve the issue.

Fix

Memory Leak

Information Disclosure

Weakness Enumeration

CWE-401

CWE-200

Related Identifiers

CVE-2023-0248

Affected Products

Kantech Gen1 Iosmart Card Reader

References · 7

• https://osv.dev/vulnerability/CVE-2023-0248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0248 · Security Note
• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://t.me/cvenotify/63839 · Telegram Post
• https://t.me/cvenotify/63845 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-348-02 · Note
• https://twitter.com/CVEnew/status/1735407770692706737 · Twitter Post