Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Secure Elements Class 5 client can leak memory

CVE-2006-2708 · published 20 years ago
Summary

The Secure Elements Class 5 AVR client (C5 EVM) versions before 2.8.1 can be tricked into exposing parts of its own memory. An attacker can send specially crafted messages that cause the software to read beyond the intended data limits, potentially revealing sensitive information. Update the client to version 2.8.1 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
secure_elements class_5_enterprise_vulnerability_management 2.8.0
cpe:2.3:a:secure_elements:class_5_enterprise_vulnerability_management:2.8.0:*:*:*:*:*:*:*
Original advisory text
Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size for (1) EM_GET_CE_PARAMETER and (2) EM_SET_CE_PARAMETER m...
Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size for (1) EM_GET_CE_PARAMETER and (2) EM_SET_CE_PARAMETER messages, which leads to a buffer overflow (probably an over-read).
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published31 May 2006
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-2708 · NVD
Track software like this
Free during beta