CVE-2025-8699 - CVE House
Back to Database
Status published Unknown CVE-2025-8699

Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable...

Vulnerability Description

Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By carefully observing changes in card dumps, one can identify fields that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the cash and an unknown field with a certain value. By updating the fields accordingly, arbitrary amounts of money can be loaded onto the card (up to $655,35) to pay for goods.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8699

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Steffen Robertz, SEC Consult Vulnerability Lab

References

Affected Vendor

Affected Software

Stored Value Unattended Payment Solution
Vulnerable Versions:
Current firmware/hardware as of Q2/2025

Timeline

Official Publish: September 12th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-922

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.