CVE-2023-0248: Kantech Gen1 ioSmart card reader

Q: What is the severity of CVE-2023-0248?

CVE-2023-0248 has been classified with a moderate severity due to the potential for data recovery with physical access.

Q: How do I fix CVE-2023-0248?

To mitigate CVE-2023-0248, upgrade the Kantech Gen1 ioSmart card reader firmware to version 1.07.02 or later.

Q: What systems are affected by CVE-2023-0248?

CVE-2023-0248 affects Kantech Gen1 ioSmart card readers running firmware versions prior to 1.07.02.

Q: What is the impact of CVE-2023-0248?

The impact of CVE-2023-0248 is that an attacker could potentially recover sensitive communication memory between the card and the reader.

Q: Who is the vendor for CVE-2023-0248?

The vendor for CVE-2023-0248 is Johnson Controls, which produces the Kantech Gen1 ioSmart card reader.

Published Dec 14, 2023

Updated

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

Affected Software

2 affected components

All of the following

Johnsoncontrols Iosmart Gen 1 Firmware<1.07.02

Johnsoncontrols Iosmart Gen 1

Remediation

Information

Update ioSmart Gen1 card reader to firmware version 1.07.02 or higher. Download the update here: https://www.kantech.com/Resources/GetDoc.aspx?p=1&id=58679 https://www.kantech.com/Resources/GetDoc.aspx Contact technical support for additional information. ioSmart Gen2 readers are not affected by this behavior. Contact your local sales representative for ordering information.

Event History

Dec 14, 2023

CVE Published

08:57 PM

Data Sourced

08:57 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-0248?

CVE-2023-0248 has been classified with a moderate severity due to the potential for data recovery with physical access.

How do I fix CVE-2023-0248?