Read the docs
TI-2023-16393 Aliases CVE-2023-33217GHSA-5x62-mg99-p2p2

Missing integrity check on upgrade package

Priority LOW 34CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. the only way to recover the terminal is by sending back the terminal to the manufacturer

Why it matters now

EPSS 0.00676 52nd percentileScored 2026-11-07
Fix Fixed SIGMA Lite & Lite + (IDEMIA): 4.15.5SIGMA Wide (IDEMIA): 4.15.5+4 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IDEMIASIGMA Lite & Lite +before 4.15.54.15.5Patch availableCNA
IDEMIASIGMA Widebefore 4.15.54.15.5Patch availableCNA
IDEMIASIGMA Extremebefore 4.15.54.15.5Patch availableCNA
IDEMIAMorphoWave Compact/XPbefore 2.12.22.12.2Patch availableCNA
IDEMIAVisionPassbefore 2.12.22.12.2Patch availableCNA
IDEMIAMorphoWave SPbefore 1.2.71.2.7Patch availableCNA
  • SIGMA Lite & Lite + VendorIDEMIA Affected before 4.15.5 Fixed in 4.15.5 Patch available CNA
  • SIGMA Wide VendorIDEMIA Affected before 4.15.5 Fixed in 4.15.5 Patch available CNA
  • SIGMA Extreme VendorIDEMIA Affected before 4.15.5 Fixed in 4.15.5 Patch available CNA
  • MorphoWave Compact/XP VendorIDEMIA Affected before 2.12.2 Fixed in 2.12.2 Patch available CNA
  • VisionPass VendorIDEMIA Affected before 2.12.2 Fixed in 2.12.2 Patch available CNA
  • MorphoWave SP VendorIDEMIA Affected before 1.2.7 Fixed in 1.2.7 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:idemia:sigma_lite_firmware:*:*:*:*:*:*:*:*before 4.15.5VulnerableIDEMIA
cpe:2.3:h:idemia:sigma_lite:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
cpe:2.3:o:idemia:sigma_lite\+_firmware:*:*:*:*:*:*:*:*before 4.15.5VulnerableIDEMIA
cpe:2.3:h:idemia:sigma_lite\+:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:*before 4.15.5VulnerableIDEMIA
cpe:2.3:h:idemia:sigma_extreme:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:*before 4.15.5VulnerableIDEMIA
cpe:2.3:h:idemia:sigma_wide:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:*before 2.12.2VulnerableIDEMIA
cpe:2.3:h:idemia:morphowave_compact:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
  • cpe:2.3:o:idemia:sigma_lite_firmware:*:*:*:*:*:*:*:* Versions before 4.15.5 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:sigma_lite:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
  • cpe:2.3:o:idemia:sigma_lite\+_firmware:*:*:*:*:*:*:*:* Versions before 4.15.5 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:sigma_lite\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
  • cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:* Versions before 4.15.5 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:sigma_extreme:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
  • cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:* Versions before 4.15.5 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:sigma_wide:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
  • cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:* Versions before 2.12.2 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:morphowave_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:idemia:morphowave_xp_firmware:*:*:*:*:*:*:*:*before 2.12.2VulnerableIDEMIA
cpe:2.3:h:idemia:morphowave_xp:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
cpe:2.3:o:idemia:visionpass_firmware:*:*:*:*:*:*:*:*before 2.12.2VulnerableIDEMIA
cpe:2.3:h:idemia:visionpass:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:*before 1.2.7VulnerableIDEMIA
cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:*not specified by NVDRunning onIDEMIA
  • cpe:2.3:o:idemia:morphowave_xp_firmware:*:*:*:*:*:*:*:* Versions before 2.12.2 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:morphowave_xp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
  • cpe:2.3:o:idemia:visionpass_firmware:*:*:*:*:*:*:*:* Versions before 2.12.2 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:visionpass:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
  • cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:* Versions before 1.2.7 Vulnerable ·IDEMIA
  • cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA

Remediation

  • Fix · CNA SIGMA Lite & Lite + (IDEMIA) Fixed in 4.15.5
  • Fix · CNA SIGMA Wide (IDEMIA) Fixed in 4.15.5
  • Fix · CNA SIGMA Extreme (IDEMIA) Fixed in 4.15.5
  • Fix · CNA MorphoWave Compact/XP (IDEMIA) Fixed in 2.12.2
  • Fix · CNA VisionPass (IDEMIA) Fixed in 2.12.2
  • Fix · CNA MorphoWave SP (IDEMIA) Fixed in 1.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    IDEMIA MorphoWave Compact/XP, MorphoWave SP and 4 more products 1.2.7, 2.12.2, 4.15.5

    6 records Highest priority Priority MEDIUM 5 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2023-16398 Stack buffer overflow when reading DESFire cardPriority MEDIUM 45
    • TI-2023-16397 Heap Buffer Overflow when reading DESFire cardPriority MEDIUM 44
    • TI-2023-16396 Stack Buffer Overflow when checking some attributes during retrofitPriority MEDIUM 44
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-33217
  2. 2026-10-03 Alias added: GHSA-5x62-mg99-p2p2

References

Advisory 1

  • TI-2023-16398 Stack buffer overflow when reading DESFire card CVSS 3.1CRITICAL 9.8
  • TI-2023-16397 Heap Buffer Overflow when reading DESFire card CVSS 3.1CRITICAL 9.8
  • TI-2023-16396 Stack Buffer Overflow when checking some attributes during retrofit CVSS 3.1CRITICAL 9.8
  • TI-2023-16395 Stack Buffer Overflow when checking retrofit package CVSS 3.1CRITICAL 9.8
  • TI-2023-16394 Stack Buffer Overflow in a binary run at upgrade startup CVSS 3.1CRITICAL 9.8
  • TI-2023-04300 Stored Cross Site Scripting in webserver administration CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences