Is CVE-2024-23806 actively exploited?

No active exploitation of CVE-2024-23806 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-23806 be exploited remotely?

No. CVE-2024-23806 requires physical access to exploit.

What is the CVSS score of CVE-2024-23806?

CVE-2024-23806 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2024-23806

MEDIUM

CVE-2024-23806

CWE-285Published: February 7, 2024· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

NVD Source

Technical Analysis

CVE-2024-23806 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorPhysical

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeChanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected Vendors & Products

hidglobal4 product(s)

omnikey secure elements reader configuration cards firmwareomnikey secure elements reader configuration cardsiclass se reader configuration cards firmwareiclass se reader configuration cards

Source: NVD CPE · 4 total CPE entries