CVE & CISA-KEV Catalog

CVE-2023-40660

MEDIUM
6.6
CVSS v3
NVD

Description

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.

How to fix

Remediation Available
openscDebian
Fixed in:0.21.0-1+deb11u1CVE-2023-40660
Fixed in:0.23.0-0.3+deb12u1CVE-2023-40660
Fixed in:0.23.0-2CVE-2023-40660
Fixed in:0.23.0-2CVE-2023-40660
openscRocky
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
openscRed Hat / RHEL
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
opensc-debuginfoRocky
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
opensc-debuginfoRed Hat / RHEL
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
opensc-debugsourceRocky
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
opensc-debugsourceRed Hat / RHEL
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.20.0-7.el8_9RHSA-2023:7876
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
Fixed in:0:0.23.0-3.el9_3RHSA-2023:7879
openscUbuntu
Fixed in:0.15.0-1ubuntu1+esm2USN-7346-1
Fixed in:0.17.0-3ubuntu0.1~esm2USN-7346-1
Fixed in:0.20.0-3ubuntu0.1~esm4USN-7346-3
Fixed in:0.20.0-3ubuntu0.1~esm2USN-7346-1
Fixed in:0.22.0-1ubuntu2+esm1USN-7346-1
Fixed in:0.25.0~rc1-1ubuntu0.1~esm1USN-7346-1
opensc-pkcs11Ubuntu
Fixed in:0.15.0-1ubuntu1+esm2USN-7346-1
Fixed in:0.17.0-3ubuntu0.1~esm2USN-7346-1
Fixed in:0.20.0-3ubuntu0.1~esm4USN-7346-3
Fixed in:0.20.0-3ubuntu0.1~esm2USN-7346-1
Fixed in:0.22.0-1ubuntu2+esm1USN-7346-1
Fixed in:0.25.0~rc1-1ubuntu0.1~esm1USN-7346-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorPhysical
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploit Intelligence

0.92%probability of exploitation in 30 days
56thpercentile

Moderate risk: more likely to be exploited than 56% of all known CVEs.

References

Related Vulnerabilities

Other CWE-287 (Improper Authentication) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2023-35082Critical9.8100%KEV + RansomFix
CVE-2023-35078Critical9.8100%KEV + RansomFix
CVE-2017-7921Critical9.8100%KEV-
CVE-2024-7593Critical9.8100%KEV-
CVE-2023-46805High8.2100%KEV + Ransom-
CVE-2022-40684Critical9.8100%KEV + RansomFix
Embed a live status badge for CVE-2023-40660
CVE-2023-40660 severity badge

Markdown

[![CVE-2023-40660](https://tridentstack.com/cve/badge/CVE-2023-40660.svg)](https://tridentstack.com/cve/CVE-2023-40660)

HTML

<a href="https://tridentstack.com/cve/CVE-2023-40660"><img src="https://tridentstack.com/cve/badge/CVE-2023-40660.svg" alt="CVE-2023-40660"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-11-03.