IDEMIA
First CVE: Nov 28, 2023Active for: 3 years
7
CVEs Published
More CVEs Published than 20% of tracked CNAs
7.0
Avg CVEs / Year
More Avg CVEs / Year than 42% of tracked CNAs
8.8
Avg CVSS Score
Higher Avg CVSS Score than 96% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Self-Reporting Analysis
Of all the CVEs published by IDEMIA as a CNA, 100.0% affect products that IDEMIA develops as a vendor.
100.0%
Self-reported: 7Third-party: 0
Of all the CVEs published that affect products developed by IDEMIA, 63.6% are self-published by IDEMIA as a CNA.
63.6%
36.4%
Self-published: 7Published by other CNAs: 4
Trends Over Time
The number and severity of CVEs published by IDEMIA over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 28, 2023
2 years ago
Most Recent CVE
Dec 15, 2023
952 days ago
Top CVEs
All CVEs published by IDEMIA as a CNA, regardless of affected vendor or product.
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-33219CRITICAL
The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation
operations. This allows a stack-based buffer overflow | Dec 15, 2023 | 9.8 | 30 | NO | NO |
CVE-2023-33220CRITICAL
During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes
to check. This allows a stack-based buffer overflow | Dec 15, 2023 | 9.8 | 29 | NO | NO |
CVE-2023-33222CRITICAL
When handling contactless cards, usage of a specific function to get additional information from the card which doesn't
check the boundary on the data received while read | Dec 15, 2023 | 9.8 | 28 | NO | NO |
CVE-2023-33218CRITICAL
The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow.
This could potentially lead to a Remote Code execution on the target | Dec 15, 2023 | 9.8 | 28 | NO | NO |
CVE-2023-33221CRITICAL
When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying
internally the data received. This allows a heap based buf | Dec 15, 2023 | 9.8 | 27 | NO | NO |
CVE-2023-33217HIGH
By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent
denial of service for the terminal. the only way to recover | Dec 15, 2023 | 7.5 | 20 | NO | NO |
CVE-2023-4667MEDIUM
The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the G | Nov 28, 2023 | 4.8 | 17 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA7 CVEs
14%
14%
71%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network7 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (85.7%)
Unknown0 (0.0%)
Required1 (14.3%)
Privileges Required
Low0 (0.0%)
High1 (14.3%)
None6 (85.7%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by IDEMIA as a CNA.
Media Mentions
Media articles that mention a CVE ID published by IDEMIA as a CNA — matched by CVE ID, not by organization name.