title: Kantech Gen1 ioSmart card reader
description: An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: ioSmart Gen1
vendor: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.
versions:
lessThan: 1.07.02, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update ioSmart Gen1 card reader to firmware version 1.07.02 or higher.
Download the update here:  https://www.kantech.com/Resources/GetDoc.aspx?p=1&id=58679 https://www.kantech.com/Resources/GetDoc.aspx
Contact technical support for additional information.
ioSmart Gen2 readers are not affected by this behavior.
Contact your local sales representative for ordering information.