CVE-2023-33218: Idemia Morphowave Compact Firmware

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code execution on the targeted device.

Affected products

• Idemia Morphowave Compact Firmware: before 2.12.2 (fixed in 2.12.2)
• Idemia Morphowave SP Firmware: before 1.2.7 (fixed in 1.2.7)
• Idemia Morphowave XP Firmware: before 2.12.2 (fixed in 2.12.2)
• Idemia Sigma Extreme Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Lite+ Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Lite Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Wide Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Visionpass Firmware: before 2.12.2 (fixed in 2.12.2)

Published 2023-12-15. Last modified 2026-06-17.