Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm

According to SEC Consult, a cybersecurity consulting firm under Eviden, KioSoft took a long time to address a serious vulnerability affecting some of its NFC-based cards. SEC Consult researchers identified that the stored-value cards used by KioSoft kiosks could be exploited to top up balances for free, with the flaw linked to CVE-2025-8699 and the MiFare Classic technology known for security weaknesses.

The firm first contacted KioSoft in October 2023, but the vendor was unresponsive until involvement from the CERT Coordination Center at the Software Engineering Institute of Carnegie Mellon University, after which a firmware patch was reportedly released in the summer of 2025. SEC Consult says it has repeatedly requested status updates, many of which went unanswered, and notes that the patch timeline extended to well over a year.

KioSoft, which manufactures unattended payment terminals used in laundromats, arcades, vending machines and car washes, has not publicly disclosed version numbers of impacted or patched releases, and SEC Consult could not verify the patch on the terminals it studied.