CVE-2023-33217 Missing integrity check on upgrade package
Attackers can permanently disable biometric terminals by exploiting a missing integrity check in the firmware upgrade mechanism, requiring manufacturer return for recovery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33217?
CVE-2023-33217 is a high-severity vulnerability in IDEMIA MorphoWave Compact/XP, published on 15 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. the only way to recover the terminal is by sending back the terminal to the manufacturer
Weakness: CWE-20
Which versions are affected by CVE-2023-33217?
It affects 8 products.
Products include Idemia Morphowave Compact Firmware, Idemia Morphowave Sp Firmware, Idemia Morphowave Xp Firmware, Idemia Sigma Extreme Firmware, Idemia Sigma Lite\+ Firmware, Idemia Sigma Lite Firmware and 2 more.
How do I fix CVE-2023-33217?
No fix has been published for CVE-2023-33217 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33217 being exploited?
There is no known exploitation of CVE-2023-33217 in the wild and no public exploit code.
Other vulnerabilities in IDEMIA MorphoWave Compact/XP
- CVE-2023-33218 Stack Buffer Overflow in a binary run at upgrade startup
- CVE-2023-33219 Stack Buffer Overflow when checking retrofit package
- CVE-2023-33220 Stack Buffer Overflow when checking some attributes during retrofit
- CVE-2023-4667 Stored Cross Site Scripting in webserver administration
- CVE-2023-33221 Heap Buffer Overflow when reading DESFire card
Sources
Also known as GHSA-5x62-mg99-p2p2.