{"id":"CVE-2024-23806","aliases":["EUVD-2024-21259","GHSA-whv2-8g4p-xpx6"],"status":"published","title":"HID Global Reader Configuration Cards Improper Authorization","description":"Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00293,"percentile":0.22177,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285","CWE-287"],"published":"2024-02-07T16:23:16Z","modified":"2026-06-17T07:13:38Z","products":[{"vendor":"hid global","product":"hid iclass se reader configuration cards"},{"vendor":"hid global","product":"omnikey secure elements reader configuration cards"},{"vendor":"hidglobal","product":"iclass_se_reader_configuration_cards_firmware"},{"vendor":"hidglobal","product":"omnikey_secure_elements_reader_configuration_cards_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02"},{"url":"https://www.hidglobal.com/support","tags":["x_transferred","Product"]},{"url":"https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23806"},{"url":"https://github.com/advisories/GHSA-whv2-8g4p-xpx6"}],"sources":{"cve":[{"id":"CVE-2024-23806","title":"HID Global Reader Configuration Cards Improper Authorization","description":"Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.","status":"published","published":"2024-02-07T16:23:16.889Z","modified":"2025-06-13T15:07:44.967Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-21259","description":"Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.","status":"published","published":"2024-02-07T16:23:16Z","modified":"2025-06-13T15:07:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.065864Z"}],"ghsa":[{"id":"GHSA-whv2-8g4p-xpx6","title":"\n\n\nSensitive data can be extracted from HID iCLASS SE reader configuration cards. This could...","description":"\n\n\nSensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.\n\n\n\n","status":"published","published":"2024-02-07T18:30:27Z","modified":"2024-10-11T18:32:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-285","CWE-287"],"updated_at":"2026-11-02T14:58:29.079883Z"}],"nvd":[{"id":"CVE-2024-23806","description":"Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.","status":"published","published":"2024-02-07T17:15:10.713Z","modified":"2026-06-17T07:13:38.35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-287"],"updated_at":"2026-11-02T14:09:35.738752Z"}]}}