CVE-2024-29941
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedInsecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card number that is using the default ICT encryption.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe vulnerability involves hardcoded ICT MIFARE and DESFire encryption keys stored in plaintext within the device firmware binary. An attacker who obtains the firmware can extract these keys using static analysis and forge valid credentials for any site code and card number using the default ICT encryption scheme.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify ICT MIFARE/DESFire usageReview system documentation or hardware specifications to confirm the deployment uses ICT MIFARE or DESFire card encryption technology. Check access control system configuration for card type settings.Affected if The system uses ICT MIFARE or DESFire cards with default factory encryption keys
-
Obtain firmware binaryLocate the firmware file for the affected device. This is typically found on the manufacturer support site, within the device filesystem via FTP/SSH if accessible, or from update packages.Affected if Firmware binary is available for analysis
-
Search firmware for plaintext keysUse strings or binwalk to extract printable strings from the firmware binary. Search for hex patterns matching MIFARE DESFire keys (typically 16 or 24 bytes) or known default ICT key identifiers. Look for patterns like 'MIFARE', 'DESFire', 'key', or encryption-related headers.Affected if Plaintext encryption keys or key patterns are found in the firmware
-
Verify custom key deploymentCheck access control system configuration or key management interface to determine if default ICT encryption keys have been replaced with organization-specific keys. Review key management logs or documentation for evidence of key rotation.Affected if Default ICT encryption keys remain in use or have never been replaced
-
Check for key derivation methodExamine firmware or system documentation for the ICT encryption scheme. Determine if the system derives keys using a predictable method based on site code and card number without additional secrets.Affected if The system uses default ICT encryption scheme without unique per-installation keys
Affected if the deployment uses ICT MIFARE or DESFire technology with factory-default encryption keys still active in the firmware or system configuration.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataOrganizations should replace default encryption keys with unique, randomly generated keys; update firmware if a patch is available; and audit all systems using default ICT encryption to determine exposure.
- Consultation8.0 h
- Implementation16.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $10,240.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-29941 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-29941 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data