PatchTheCVEsigma lite\+ firmware vulnerabilities and fixes
Recent CVEs affecting sigma lite\+ firmware, with upgrade or downgrade steps. 6 tracked.
Also searched as: sigmalite\+firmware.
sigma lite\+ firmware has 6 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 6. Most recent: 2023-12-15. Highest priority: CVE-2023-33220 (score 53/100).
- CVE-2023-33222 MEDIUM 6.8 UPGRADE UPGRADE When handling contactless cards, usage of a specific function to get additional information from the
- CVE-2023-33221 MEDIUM 6.8 UPGRADE UPGRADE When reading DesFire keys, the function that reads the card isn't properly checking the boundaries wh
- CVE-2023-33220 CRITICAL 9.1 UPGRADE UPGRADE During the retrofit validation process, the firmware doesn't properly check the boundaries while copyin
- CVE-2023-33219 CRITICAL 9.1 UPGRADE UPGRADE The handler of the retrofit validation command doesn't properly check the boundaries when performing cert
- CVE-2023-33218 CRITICAL 9.1 UPGRADE UPGRADE The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow
- CVE-2023-33217 HIGH 7.5 UPGRADE UPGRADE By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a
FAQ
How do I fix sigma lite\+ firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sigma lite\+ firmware being exploited right now?
None of the tracked sigma lite\+ firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sigma lite\+ firmware CVE should I patch first?
CVE-2023-33220 currently ranks highest (53/100): During the retrofit validation process, the firmware doesn't properly check the boundaries while copyin.