CVE-2022-32961 describes a stack-based buffer overflow in HICOS' client-side digital certificate component, specifically affecting the hinet hicos_natural_person_credential_component_client. This vulnerability arises from insufficient parameter length validation when reading IC card token information. An unauthenticated physical attacker can exploit this with low complexity to achieve arbitrary code execution, data manipulation, or service termination, as indicated by its CVSS score of 6.8 (Medium). There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.3.30306CPE matchmatch criteria | cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30306:*:*:*:*:linux:*:* | ||
3.0.3.30404CPE matchmatch criteria | cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30404:*:*:*:*:macos:*:* | ||
3.1.0.00002CPE matchmatch criteria | cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.1.0.00002:*:*:*:*:windows:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.