CVE-2024-22388
Insecure Default Initialization of Resource in HID Global
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Insecure Default Initialization of Resource in HID Global
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
- Record
CVE-2024-22388- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2024-19945
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
- Record
EUVD-2024-19945- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j839-f55x-qp69
Certain configuration available in the communication channel for encoders could expose sensitive...
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
- Record
GHSA-j839-f55x-qp69- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-285, CWE-1188
- Updated
- 2026-11-02
NVD
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
- Record
CVE-2024-22388- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1188
- Updated
- 2026-11-02
Affected products
- hid global iclass se cp1000 encoder
- hid global iclass se processors
- hid global iclass se reader modules
- hid global iclass se readers
- hid global omnikey 5023 readers
- hid global omnikey 5027 readers
- hid global omnikey 5127ck readers
- hid global omnikey 5427ck readers
- hidglobal iclass se cp1000 encoder firmware
- hidglobal iclass se processors firmware
- hidglobal iclass se reader modules firmware
- hidglobal iclass se readers firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22388 is a medium vulnerability (CVSS 5.9) in Hid Global Iclass Se Cp1000 Encoder, published February 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.