What is CVE-2023-0248?

CVE-2023-0248 is a high-severity vulnerability in Johnsoncontrols Iosmart Gen 1, classified under Information Disclosure. CVSS score: 7.5/10. Published 2023-12-14.

How severe is CVE-2023-0248?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Johnsoncontrols Iosmart Gen 1

CVE-2023-0248

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

Vulnerability class: Information Disclosure

EPSS: 0.003 (22.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L.

Affected products

Johnsoncontrols Iosmart_gen_1
Johnsoncontrols Iosmart_gen_1_firmware
Sensormatic Electronics, A Subsidiary Of Johnson Controls, Inc. Iosmart Gen1 — versions 0

Weakness classification (CWE)

CWE-200 — Information Disclosure
CWE-401 — Missing Release of Memory after Effective Lifetime

References

productsecurity@jci.com (Vendor Advisory)
productsecurity@jci.com (US Government Resource, Third Party Advisory)

Frequently asked questions

What is CVE-2023-0248?: CVE-2023-0248 is a high-severity vulnerability in Johnsoncontrols Iosmart Gen 1, classified under Information Disclosure. CVSS score: 7.5/10. Published 2023-12-14.
How severe is CVE-2023-0248?: High severity. CVSS v3 base score is 7.5 out of 10.