Description
Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 does not validate the CEID of an incoming message, which allows remote attackers to send messages to a protected asset without knowing the proper CEID.
References
- c5evm-ceid-weak-security(26783) vdb-entry
- VU#635721 third-party-advisory
- 20378 third-party-advisory
- ADV-2006-2069 vdb-entry
- 1016184 vdb-entry
- http://www.kb.cert.org/vuls/id/WDON-6Q6SDL