Read the docs
TI-2024-14963 Aliases CVE-2024-22388GHSA-j839-f55x-qp69

Insecure Default Initialization of Resource in HID Global

Priority LOW 33CWE-1188Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HID GlobaliCLASS SE CP1000 EncoderAll—No fix listedCNA
HID GlobaliCLASS SE ReadersAll—No fix listedCNA
HID GlobaliCLASS SE Reader ModulesAll—No fix listedCNA
HID GlobaliCLASS SE ProcessorsAll—No fix listedCNA
HID GlobalOMNIKEY 5427CK ReadersAll—No fix listedCNA
HID GlobalOMNIKEY 5127CK ReadersAll—No fix listedCNA
HID GlobalOMNIKEY 5023 ReadersAll—No fix listedCNA
HID GlobalOMNIKEY 5027 ReadersAll—No fix listedCNA
  • iCLASS SE CP1000 Encoder VendorHID Global Affected All Fixed in — No fix listed CNA
  • iCLASS SE Readers VendorHID Global Affected All Fixed in — No fix listed CNA
  • iCLASS SE Reader Modules VendorHID Global Affected All Fixed in — No fix listed CNA
  • iCLASS SE Processors VendorHID Global Affected All Fixed in — No fix listed CNA
  • OMNIKEY 5427CK Readers VendorHID Global Affected All Fixed in — No fix listed CNA
  • OMNIKEY 5127CK Readers VendorHID Global Affected All Fixed in — No fix listed CNA
  • OMNIKEY 5023 Readers VendorHID Global Affected All Fixed in — No fix listed CNA
  • OMNIKEY 5027 Readers VendorHID Global Affected All Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:hidglobal:iclass_se_cp1000_encoder_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:iclass_se_cp1000_encoder:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
cpe:2.3:o:hidglobal:iclass_se_readers_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:iclass_se_readers:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
cpe:2.3:o:hidglobal:iclass_se_reader_modules_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:iclass_se_reader_modules:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
cpe:2.3:o:hidglobal:iclass_se_processors_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:iclass_se_processors:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
cpe:2.3:o:hidglobal:omnikey_5427ck_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:omnikey_5427ck:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
  • cpe:2.3:o:hidglobal:iclass_se_cp1000_encoder_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:iclass_se_cp1000_encoder:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
  • cpe:2.3:o:hidglobal:iclass_se_readers_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:iclass_se_readers:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
  • cpe:2.3:o:hidglobal:iclass_se_reader_modules_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:iclass_se_reader_modules:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
  • cpe:2.3:o:hidglobal:iclass_se_processors_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:iclass_se_processors:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
  • cpe:2.3:o:hidglobal:omnikey_5427ck_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:omnikey_5427ck:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hidglobal:omnikey_5127ck_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:omnikey_5127ck:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
cpe:2.3:o:hidglobal:omnikey_5023_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:omnikey_5023:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
cpe:2.3:o:hidglobal:omnikey_5027_firmware:*:*:*:*:*:*:*:*all versionsVulnerableHID Global
cpe:2.3:h:hidglobal:omnikey_5027:-:*:*:*:*:*:*:*not specified by NVDRunning onHID Global
  • cpe:2.3:o:hidglobal:omnikey_5127ck_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:omnikey_5127ck:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
  • cpe:2.3:o:hidglobal:omnikey_5023_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:omnikey_5023:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global
  • cpe:2.3:o:hidglobal:omnikey_5027_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·HID Global
  • cpe:2.3:h:hidglobal:omnikey_5027:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HID Global

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22388
  2. 2026-10-03 Alias added: GHSA-j839-f55x-qp69

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences