{"id":75980,"date":"2025-09-18T19:55:10","date_gmt":"2025-09-18T19:55:10","guid":{"rendered":""},"modified":"2025-09-28T15:47:07","modified_gmt":"2025-09-28T21:47:07","slug":"cve-2025-8699-exploitation-of-stored-value-nfc-cards-vulnerability-in-kiosoft-payment-solutions","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-8699-exploitation-of-stored-value-nfc-cards-vulnerability-in-kiosoft-payment-solutions\/","title":{"rendered":"CVE-2025-8699: Exploitation of “Stored Value” NFC Cards Vulnerability in KioSoft Payment Solutions<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This blog post delves into the CVE-2025-8699 vulnerability identified in certain “Stored Value” Unattended Payment Solutions offered by KioSoft. This vulnerability stands out due to the potential abuse of NFC (Near Field Communication) cards’ insecure storage of account balances, potentially allowing attackers to manipulate these balances to their advantage. Given the ubiquity of NFC cards in modern payment systems, this vulnerability could have far-reaching implications for individuals and businesses<\/a> alike.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-8699
\nSeverity: Critical (9.1 CVSS Score)
\nAttack Vector: Physical
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: Potential System<\/a> Compromise and Data Leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

KioSoft Unattended Payment Solutions | All versions using insecure MiFare Classic NFC cards<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit works by manipulating the data stored on the NFC card. The NFC card used in these KioSoft solutions is a MiFare Classic card, which has a known vulnerability where the stored data<\/a> can be read and written back. By observing changes in card dumps, an attacker can identify the fields storing the cash value and a checksum. The checksum is created by XOR-ing the cash value with an unknown field and a certain value. Once these fields are identified, the attacker can update them to load arbitrary amounts of money onto the card, up to $655.35.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Given the physical nature of this exploit, traditional example code like HTTP requests or shell commands<\/a> won’t be applicable. Instead, let’s provide a simplified pseudocode representation of the process:<\/p>\n

card_data = ReadNFCData(card)\ncash_value_field = IdentifyCashValueField(card_data)\nchecksum_field = IdentifyChecksumField(card_data)\nnew_cash_value = ArbitraryValue(up to $655.35)\nupdated_card_data = UpdateCardData(card_data, cash_value_field, new_cash_value)\nupdated_checksum = CalculateChecksum(updated_card_data, checksum_field)\nWriteNFCData(card, updated_card_data, updated_checksum)<\/code><\/pre>\n
Mitigation Guidance<\/strong><\/p>\n
To mitigate this vulnerability, users are recommended to apply the vendor patch once it becomes available. Until then, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could serve as a temporary mitigation. These systems can help identify and block attempts to exploit vulnerabilities<\/a>, providing an additional layer of security in the interim.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This blog post delves into the CVE-2025-8699 vulnerability identified in certain “Stored Value” Unattended Payment Solutions offered by KioSoft. This vulnerability stands out due to the potential abuse of NFC (Near Field Communication) cards’ insecure storage of account balances, potentially allowing attackers to manipulate these balances to their advantage. Given the ubiquity of NFC […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-75980","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t