HiCOS Citizen verification component - Stack Buffer Overflow
Priority LOW 30CWE-787Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
Why it matters now
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HINET | HiCOS Citizen verification component - Stack Buffer Overflow | libHicos_p11v1.so CHT PKCS#11 3.0.3.30306 | — | No fix listed | CNA |
| HINET | HiCOS Citizen verification component - Stack Buffer Overflow | HiCOSPKCS11.dll CHT PKCS#11 3.1.0.00002 | — | No fix listed | CNA |
| HINET | HiCOS Citizen verification component - Stack Buffer Overflow | libHicos_p11v1.dylib CHT PKCS#11 3.0.3.30404 | — | No fix listed | CNA |
- HiCOS Citizen verification component - Stack Buffer Overflow VendorHINET Affected libHicos_p11v1.so CHT PKCS#11 3.0.3.30306 Fixed in — No fix listed CNA
- HiCOS Citizen verification component - Stack Buffer Overflow VendorHINET Affected HiCOSPKCS11.dll CHT PKCS#11 3.1.0.00002 Fixed in — No fix listed CNA
- HiCOS Citizen verification component - Stack Buffer Overflow VendorHINET Affected libHicos_p11v1.dylib CHT PKCS#11 3.0.3.30404 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30306:*:*:*:*:linux:*:* | 3.0.3.30306 | Vulnerable | HINET |
| cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30404:*:*:*:*:macos:*:* | 3.0.3.30404 | Vulnerable | HINET |
| cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.1.0.00002:*:*:*:*:windows:*:* | 3.1.0.00002 | Vulnerable | HINET |
- cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30306:*:*:*:*:linux:*:* Versions 3.0.3.30306 Vulnerable ·HINET
- cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.0.3.30404:*:*:*:*:macos:*:* Versions 3.0.3.30404 Vulnerable ·HINET
- cpe:2.3:a:hinet:hicos_natural_person_credential_component_client:3.1.0.00002:*:*:*:*:windows:*:* Versions 3.1.0.00002 Vulnerable ·HINET
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35222
- 2026-10-03 Alias added: GHSA-x9w7-3869-cc5q
References
More HINET Hicos Natural Person Credential Component Client vulnerabilities
- TI-2022-14480 HiCOS’ client-side citizen digital certificate - Double Free CVSS 3.1MEDIUM 6.8
- TI-2022-14479 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
- TI-2022-14478 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
- TI-2022-14477 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow CVSS 3.1MEDIUM 6.8
Sources
- CVE-2022-35222 · CVE Program
- CVE-2022-35222 · NVD
- FIRST EPSS
- GHSA-x9w7-3869-cc5q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences