PT-2025-36492 · Kiosoft+1 · Kiosoft "Stored Value" Unattended Payment Solutions+1

Steffen Robertz · Published 2025-09-08 · Updated 2025-09-17 · CVE-2025-8699

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: KioSoft "Stored Value" Unattended Payment Solutions (affected versions not specified)

Description: KioSoft "Stored Value" Unattended Payment Solutions utilize vulnerable NFC cards. An attacker could potentially modify the balance on these cards, leading to unauthorized funds. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written. By analyzing card dumps, attackers can identify the cash value field and a checksum calculated by XOR-ing the cash value with an unknown field. Manipulating these fields allows for arbitrary amounts of money to be added to the card, up to a limit of $655.35.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2025-8699

Affected Products

Kiosoft "Stored Value" Unattended Payment Solutions

Mifare Classic

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-8699 · Security Note
• https://t.me/cveNotify/135227 · Telegram Post
• https://twitter.com/cracbot/status/1968268764006486405 · Twitter Post
• https://twitter.com/autumn_good_35/status/1965035428740047052 · Twitter Post
• https://t.me/cveNotify/135590 · Telegram Post
• https://twitter.com/zeeshankghouri/status/1968151970642006070 · Twitter Post
• https://r.sec-consult.com/kiosoft · Note
• https://t.me/CVEtracker/32370 · Telegram Post
• https://twitter.com/CVEnew/status/1966466079770693649 · Twitter Post
• http://seclists.org/fulldisclosure/2025/Sep/33 · Note