Insecure Storage of Encryption Keys Exposes Millions of Cards to Hacking
CVE-2024-29941

Currently unrated

Key Information:

Vendor: Integrated Control Technology
Status: Tsec
Vendor: CVE Published:; 6 May 2024

🔔 Create Integrated Control Technology Vulnerability Alert

What is CVE-2024-29941?

Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card number that is using the default ICT encryption.

Affected Version(s)

TSEC 0

References

https://ict.co/media/1xdhaugi/credential-cloning.pdf

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 6, 2024
Vulnerability Reserved
Mar 21, 2024

Credit

Thomas Hobson

CVE-2024-29941 Data

JSON