CyberSecBulletin
CVE-2024-22388NVD status: Modified

iCLASS SE CP1000 Encoder: Initialization of a Resource with an Insecure Default

Published Updated By the CyberSecBulletin desk

CVE-2024-22388 is a high-severity initialization of a resource with an insecure default vulnerability in iCLASS SE CP1000 Encoder from HID Global, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. Affected iCLASS SE CP1000 Encoder versions: All. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of iCLASS SE CP1000 Encoder you run against the affected versions below, and install the vendor's latest release.

Affected products and versions

VendorProductAffected versionsFixed in
HID GlobaliCLASS SE CP1000 EncoderAllNot stated
HID GlobaliCLASS SE ReadersAllNot stated
HID GlobaliCLASS SE Reader ModulesAllNot stated
HID GlobaliCLASS SE ProcessorsAllNot stated
HID GlobalOMNIKEY 5427CK ReadersAllNot stated
HID GlobalOMNIKEY 5127CK ReadersAllNot stated
HID GlobalOMNIKEY 5023 ReadersAllNot stated
HID GlobalOMNIKEY 5027 ReadersAllNot stated
HidglobalIclass Se Cp1000 Encoder FirmwareNot specified in the recordNot stated
HidglobalIclass Se Readers FirmwareNot specified in the recordNot stated
HidglobalIclass Se Reader Modules FirmwareNot specified in the recordNot stated
HidglobalIclass Se Processors FirmwareNot specified in the recordNot stated
HidglobalOmnikey 5427ck FirmwareNot specified in the recordNot stated
HidglobalOmnikey 5127ck FirmwareNot specified in the recordNot stated
HidglobalOmnikey 5023 FirmwareNot specified in the recordNot stated
HidglobalOmnikey 5027 FirmwareNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.15.9MediumCNA (hq.dhs.gov)
CVSS 3.17.8HighNVD

Official description

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

More Initialization of a Resource with an Insecure Default vulnerabilities (CWE-1188)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other references

Recent Initialization of a Resource with an Insecure Default vulnerabilities

Spotted an error? Tell us.