CVE-2025-8699 identifies a critical vulnerability in KioSoft's Stored Value Unattended Payment Solution, which relies on MiFare Classic NFC cards to store monetary balances. The vulnerability stems from the insecure storage of sensitive information on these NFC cards, specifically the account balance data. MiFare Classic cards are known for weak security features, including easily reversible encryption and lack of robust authentication mechanisms. Attackers can exploit this by reading the card data dumps, analyzing changes to identify the fields representing the cash balance, and reverse-engineering the checksum mechanism, which is computed by XOR-ing the cash value with an unknown field and a constant. By manipulating these fields and recalculating the checksum accordingly, an attacker can arbitrarily increase the stored balance on the card, up to a maximum of $65,535. This effectively allows unauthorized generation of funds that can be used to pay for goods or services without legitimate payment. The vulnerability affects current firmware and hardware versions as of Q2 2025 and does not require network access or authentication, as the attack is performed directly on the physical NFC card. No patches or mitigations have been published yet, and there are no known exploits in the wild at the time of reporting. The root cause is classified under CWE-922, indicating insecure storage of sensitive information, which in this case leads to a direct financial impact due to the ability to counterfeit stored value balances.

For European organizations deploying KioSoft's Stored Value Unattended Payment Solutions, this vulnerability poses a significant financial risk. Attackers can exploit the weak security of MiFare Classic cards to fraudulently increase stored balances, resulting in direct monetary losses. Retailers, transit authorities, parking services, and other unattended payment systems relying on these cards could face revenue leakage. Additionally, the trustworthiness of the payment system is undermined, potentially damaging brand reputation and customer confidence. Since the attack requires physical access to the NFC cards, organizations with high card circulation or unattended card usage in public spaces are particularly vulnerable. The lack of authentication and network dependency means that the threat can be exploited offline, complicating detection and prevention. European organizations may also face regulatory scrutiny under data protection and financial transaction regulations if fraud incidents occur due to inadequate security measures. The vulnerability could also facilitate money laundering or other illicit financial activities if exploited at scale.

Immediate mitigation should focus on transitioning away from MiFare Classic NFC cards to more secure alternatives such as MiFare DESFire or other NFC cards with strong cryptographic protections and mutual authentication. Organizations should implement end-to-end encryption of stored value data and employ secure backend validation of transactions rather than relying solely on card-stored balances. Physical security controls should be enhanced to limit unauthorized access to NFC cards, including tamper-evident card designs and secure card issuance processes. Monitoring transaction patterns for anomalies indicative of fraudulent balance manipulation can help detect exploitation attempts. Until patches or hardware upgrades are available, organizations should consider disabling or limiting the use of vulnerable cards in unattended payment solutions. Vendor engagement with KioSoft is critical to accelerate the development and deployment of firmware or hardware updates that address this vulnerability. Additionally, educating staff and users about the risks and signs of card tampering can aid in early detection.