Overview
This blog post delves into the CVE-2025-8699 vulnerability identified in certain “Stored Value” Unattended Payment Solutions offered by KioSoft. This vulnerability stands out due to the potential abuse of NFC (Near Field Communication) cards’ insecure storage of account balances, potentially allowing attackers to manipulate these balances to their advantage. Given the ubiquity of NFC cards in modern payment systems, this vulnerability could have far-reaching implications for individuals and businesses alike.
Vulnerability Summary
CVE ID: CVE-2025-8699
Severity: Critical (9.1 CVSS Score)
Attack Vector: Physical
Privileges Required: None
User Interaction: Required
Impact: Potential System Compromise and Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
KioSoft Unattended Payment Solutions | All versions using insecure MiFare Classic NFC cards
How the Exploit Works
The exploit works by manipulating the data stored on the NFC card. The NFC card used in these KioSoft solutions is a MiFare Classic card, which has a known vulnerability where the stored data can be read and written back. By observing changes in card dumps, an attacker can identify the fields storing the cash value and a checksum. The checksum is created by XOR-ing the cash value with an unknown field and a certain value. Once these fields are identified, the attacker can update them to load arbitrary amounts of money onto the card, up to $655.35.
Conceptual Example Code
Given the physical nature of this exploit, traditional example code like HTTP requests or shell commands won’t be applicable. Instead, let’s provide a simplified pseudocode representation of the process:
card_data = ReadNFCData(card)
cash_value_field = IdentifyCashValueField(card_data)
checksum_field = IdentifyChecksumField(card_data)
new_cash_value = ArbitraryValue(up to $655.35)
updated_card_data = UpdateCardData(card_data, cash_value_field, new_cash_value)
updated_checksum = CalculateChecksum(updated_card_data, checksum_field)
WriteNFCData(card, updated_card_data, updated_checksum)Mitigation Guidance
To mitigate this vulnerability, users are recommended to apply the vendor patch once it becomes available. Until then, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could serve as a temporary mitigation. These systems can help identify and block attempts to exploit vulnerabilities, providing an additional layer of security in the interim.
