KioSoft Stored Value Unattended Payment Solution sensitive information

Summaryinfo

A vulnerability, which was classified as problematic, has been found in KioSoft Stored Value Unattended Payment Solution. This affects an unknown part. The manipulation leads to sensitive information. This vulnerability is referenced as CVE-2025-8699. No exploit is available.

Detailsinfo

A vulnerability was found in KioSoft Stored Value Unattended Payment Solution (affected version unknown). It has been rated as problematic. This issue affects an unknown functionality. The manipulation with an unknown input leads to a sensitive information vulnerability. Using CWE to declare the problem leads to CWE-922. The product stores sensitive information without properly limiting read or write access by unauthorized actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By carefully observing changes in card dumps, one can identify fields that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the cash and an unknown field with a certain value. By updating the fields accordingly, arbitrary amounts of money can be loaded onto the card (up to $655,35) to pay for goods.

The weakness was published by Steffen Robertz. The identification of this vulnerability is CVE-2025-8699 since 08/07/2025. The exploitation is known to be difficult. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• KioSoft

Name

• Stored Value Unattended Payment Solution

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion