CVE-2023-33219: Idemia Morphowave Compact Firmware

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device

Affected products

• Idemia Morphowave Compact Firmware: before 2.12.2 (fixed in 2.12.2)
• Idemia Morphowave SP Firmware: before 1.2.7 (fixed in 1.2.7)
• Idemia Morphowave XP Firmware: before 2.12.2 (fixed in 2.12.2)
• Idemia Sigma Extreme Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Lite+ Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Lite Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Wide Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Visionpass Firmware: before 2.12.2 (fixed in 2.12.2)

Published 2023-12-15. Last modified 2026-06-17.