VulnerabilityDeferred

CVE-2026-59776

Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017.

HIGH 7.0EPSS 0.14%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with.

CVSS 4.0: 7.0 HIGHCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-325
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/jp/JVN40509781/
https://www.sony.co.jp/en/Products/felica/business/information/2025001.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.