title: HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow
description: HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
problem types: CWE-787 Out-of-bounds Write
affected:
{
platforms: Linux
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions:
lessThanOrEqual: 11 3.0.3.30306, status: affected, version: unspecified, versionType: custom
}
{
platforms: Windows
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions:
lessThanOrEqual: 11 3.1.0.00002, status: affected, version: unspecified, versionType: custom
}
{
platforms: macOS
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
versions:
lessThanOrEqual: 11 3.0.3.30404, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Download latest version