{"timestamp":"2024-02-13T21:03:38.527676Z","id":"CVE-2023-0248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.","product":"ioSmart Gen1","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.07.02","versionType":"custom","status":"affected"}]}]

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

NIST AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST CWE-401

AND
     OR
          *cpe:2.3:o:johnsoncontrols:iosmart_gen_1_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.07.02
     OR
          cpe:2.3:h:johnsoncontrols:iosmart_gen_1:-:*:*:*:*:*:*:*

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 No Types Assigned

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 Third Party Advisory, US Government Resource

https://www.johnsoncontrols.com/cyber-solutions/security-advisories No Types Assigned

https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.2 in certain circumstances can recover the reader's communication memory between the card and reader.

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.7.2 in certain circumstances can recover the reader's communication memory between the card and reader.

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.2 in certain circumstances can recover the reader's communication memory between the card and reader.

An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.7.2 in certain circumstances can recover the reader's communication memory between the card and reader.

Johnson Controls AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L

Johnson Controls CWE-200

Johnson Controls CWE-401

Johnson Controls https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02 [No types assigned]

Johnson Controls https://www.johnsoncontrols.com/cyber-solutions/security-advisories [No types assigned]