CVE-2024-22388 - CVE House
Back to Database
Status published Medium CVE-2024-22388

Insecure Default Initialization of Resource in HID Global

Vulnerability Description

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-22388

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • HID Global reported this vulnerability to CISA.

References

More from HID Global

View All →
CVE-2024-23806
HID Global Reader Configuration Cards Improper Authorization
Medium 5.3
CVE-2023-2904
CVE-2023-2904
Unknown 0
CVE-2021-47859
ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path
High 8.5
CVE-2018-17492
EasyLobby Solo contains default administrative credentials. An attacker could exploit...
High 8.4
CVE-2018-17491
EasyLobby Solo could allow a local attacker to gain elevated...
High 8.4

Affected Vendor

Affected Software

iCLASS SE CP1000 Encoder, iCLASS SE Readers, iCLASS SE Reader Modules, iCLASS SE Processors, OMNIKEY 5427CK Readers, OMNIKEY 5127CK Readers, OMNIKEY 5023 Readers, OMNIKEY 5027 Readers
Vulnerable Versions:
All

Timeline

Official Publish: February 6th, 2024
Last Modified: May 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-1188

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.