CVE-2021-33881
Estado: ModificadaMedia (4.2)—
On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Puntuación base: 4.2
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.41%
- Percentil entre todas las CVEs puntuadas: 33
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (8)
CWE
- CWE-863
Referencias
- https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html
- https://www.nxp.com/docs/en/application-note/AN11340.pdf
- https://www.nxp.com/docs/en/application-note/AN13089.pdf
- https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/
- https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html
- https://www.nxp.com/docs/en/application-note/AN11340.pdf
- https://www.nxp.com/docs/en/application-note/AN13089.pdf
- https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-33881",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 1.9,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.4,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.2,
"attackVector": "PHYSICAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 0.5
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-06-06T16:15:07.407",
"references": [
{
"url": "https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.nxp.com/docs/en/application-note/AN11340.pdf",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.nxp.com/docs/en/application-note/AN13089.pdf",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.nxp.com/docs/en/application-note/AN11340.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.nxp.com/docs/en/application-note/AN13089.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a \"tear off\" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc."
},
{
"lang": "es",
"value": "En las tarjetas NXP MIFARE Ultralight y NTAG, un atacante puede interrumpir una operación de escritura (también se conoce como ataque \"tear off\") mediante RFID para omitir el mecanismo de protección Monotonic Counter. El impacto depende de cómo es usado la funcionalidad anti tear-off en aplicaciones específicas como el transporte público, el control de acceso físico, etc"
}
],
"lastModified": "2026-06-17T03:55:19.630",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:mifare_ultralight_ev1_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13FC8374-6D01-4B5F-A95D-596AB68702E6"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:mifare_ultralight_ev1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "40001813-D7BF-4034-8907-502337123585"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:mifare_ultralight_c_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEA8BE8B-B593-48A3-A09E-A29FDC0624FC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:mifare_ultralight_c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5B81CEC9-BE41-4193-AF43-0A26763E3054"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:mifare_ultralight_nano_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A63B6661-6124-4DA9-AB26-3BEC10554A32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:mifare_ultralight_nano:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "17D7AEEF-C5D3-49BB-A2FC-99F1925AC89E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:ntag_210_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C6ED991-07E5-400C-BAD3-77CCE7CC38FA"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:ntag_210:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E696E548-CD46-4AD3-92B5-E8DC36EC3612"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:ntag_212_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30D83C6E-3CC4-4964-8810-612636BECD6A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:ntag_212:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7477739A-1485-4C9A-98F8-1BDA70590216"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:ntag_213_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E492E74-6226-4EC8-8A7B-CF7BD3F99EF7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:ntag_213:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4D6AAD29-CDA6-4DC0-A328-085ADFC5F48B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:ntag_215_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37047CF6-875B-4503-AA72-B35F8045F08A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:ntag_215:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5A06E609-2E4D-40AF-9786-3C851ED21105"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:ntag_216_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5411DC55-0990-4314-8575-6F54B0F2FFD7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:ntag_216:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FDEB5A51-A805-4B8E-939D-C5DEF22D0084"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}