HiCOS’ client-side citizen digital certificate - Double Free
Priority LOW 30CWE-415Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.
Summary
HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.
Why it matters now
EPSS 0.0023 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HINET | HiCOS’ client-side citizen digital certificate | up to 11 3.0.3.30306 | — | No fix listed | CNA |
| HINET | HiCOS’ client-side citizen digital certificate | up to 11 3.1.0.00002 | — | No fix listed | CNA |
| HINET | HiCOS’ client-side citizen digital certificate | up to 11 3.0.3.30404 | — | No fix listed | CNA |
- HiCOS’ client-side citizen digital certificate VendorHINET Affected up to 11 3.0.3.30306 Fixed in — No fix listed CNA
- HiCOS’ client-side citizen digital certificate VendorHINET Affected up to 11 3.1.0.00002 Fixed in — No fix listed CNA
- HiCOS’ client-side citizen digital certificate VendorHINET Affected up to 11 3.0.3.30404 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30306:*:*:*:*:linux:*:* | 3.0.3.30306 | Vulnerable | HINET |
| cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30404:*:*:*:*:macos:*:* | 3.0.3.30404 | Vulnerable | HINET |
| cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.1.0.00002:*:*:*:*:windows:*:* | 3.1.0.00002 | Vulnerable | HINET |
- cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30306:*:*:*:*:linux:*:* Versions 3.0.3.30306 Vulnerable ·HINET
- cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30404:*:*:*:*:macos:*:* Versions 3.0.3.30404 Vulnerable ·HINET
- cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.1.0.00002:*:*:*:*:windows:*:* Versions 3.1.0.00002 Vulnerable ·HINET
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32962
- 2026-10-03 Alias added: GHSA-3pg9-mr9f-v7qm
References
More HINET Hicos Natural Person Credential Component Client vulnerabilities
- TI-2022-15906 HiCOS Citizen verification component - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
- TI-2022-14479 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
- TI-2022-14478 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
- TI-2022-14477 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
Sources
- CVE-2022-32962 · CVE Program
- CVE-2022-32962 · NVD
- FIRST EPSS
- GHSA-3pg9-mr9f-v7qm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences