Management Summary
The "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money.
Vendor description
"KioSoft – a technology leader in the Payments industry since 2002. We offer the best of the world in unattended payments with our global presence. The self-service industry is typically comprised of technology aggregators, as opposed to technology innovators. KioSoft is the latter. We believe that innovation comes from ownership and control of the products we design. This single source, customer- focused mentality is evident in everything we do. We never stop innovating. We continually push the boundaries to bring new ideas to life."
Source: https://kiosoft.com/about-us/
Business recommendation
Some KioSoft customers currently use outdated MiFare Classic cards in "Stored Value" Unattended Payment Solutions from KioSoft. A new detection algorithm has been rolled out through firmware according to KioSoft. As a long-term fix, hardware changes with a new reader and secure cards are planned as well. KioSoft understands that its customers continually take steps to track suspicious activity as routine.
Mifare Classic cards have been found to be vulnerable to attacks in the past, allowing these cards to be modified or copied. A short-term solution may be to transition away from the Stored Value Payment System to the Online Payment System of KioSoft, which does not have this vulnerability according to the vendor.
For further information regarding Mifare Classic security see: https://en.wikipedia.org/wiki/MIFARE#Security
Contact the supplier for details about updated firmware and hardware solutions which address this issue.
Vulnerability overview/description
1) NFC Card Vulnerability Exploitation Leading to Free Top-Up (CVE-2025-8699)
The account balance is stored on an insecure MiFare Classic NFC card in some KioSoft "Stored Value" Unattended Payment Solutions. This means the cards can be read and written back. By manipulating the right field, one can "create Money out of thin air" and use it to pay for goods.
Proof of concept
1) NFC Card Vulnerability Exploitation Leading to Free Top-Up (CVE-2025-8699)
Some KioSoft payment cards use a MiFare Classic card. This card type is inherently insecure due to its use of the insecure, proprietary Crypto1 algorithm developed by NXP (security statement: https://www.mifare.net/en/products/chip-card-ics/mifare-classic/security-statement-on-crypto1-implementations/).
Thus, all contents can be read if one owns the correct Hardware (e.g., a Proxmark). By carefully observing changes in card dumps, one can identify fields that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the cash and an unknown field with a certain value and [redacted]. By updating the fields accordingly, arbitrary amounts of money can be loaded onto the Card (up to $655,35).
In order to exploit this, a correct dump file has to be obtained first. This can be done by, e.g., running the following Proxmark command:
hf mf autopwnThis will generate a .bin file of the card's content and a file containing the keys per block. The dump file can then be modified using the following Python script:
[ Proof of concept exploit removed ]After the modification, the file can then be written to a Chinese magic tag by issuing the following Proxmark command:
hf mf cload -f kiosoft_mod.binFurther, the UID has to be modified to the UID of the original KioSoft tag (displayed when running the script) by issuing following Proxmark command:
hf mf csetuid -u <uid>Now, the card is topped-up to the amount provided to the script and can be used to pay at any KioSoft terminal.
Vulnerable / tested versions
It was not possible to determine a software version. As of Q1/2025, all cards in use are affected.