CVE-2022-32959CWE-787

HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

Medium · published July 20, 2022

CVSS v3.1
6.8
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for OS information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00235 · 13.7th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2022-07-20T02:02Z
EPSS history
Timeline
  • 20 JUL 02:02Z
    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow
    cvelistv5