CVE-2021-33881

On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.

• CWE-863

• https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.htmlMitigation, Third Party Advisory
• https://www.nxp.com/docs/en/application-note/AN11340.pdfVendor Advisory
• https://www.nxp.com/docs/en/application-note/AN13089.pdfVendor Advisory
• https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/Exploit, Third Party Advisory
• https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.htmlMitigation, Third Party Advisory
• https://www.nxp.com/docs/en/application-note/AN11340.pdfVendor Advisory
• https://www.nxp.com/docs/en/application-note/AN13089.pdfVendor Advisory
• https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/Exploit, Third Party Advisory

Published

Jun 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33850There is a Cross-Site Scripting vulnerability in Microsoft C…5.4
• CVE-2021-33851A cross-site scripting (XSS) attack can cause arbitrary code…5.4
• CVE-2021-33852A cross-site scripting (XSS) attack can cause arbitrary code…5.4
• CVE-2021-33853A Cross-Site Scripting (XSS) attack can cause arbitrary code…5.4
• CVE-2021-33879Tencent GameLoop before 4.1.21.90 downloaded updates over an…8.1
• CVE-2021-33880The aaugustin websockets library before 9.1 for Python has a…5.9
• CVE-2021-33882A Missing Authentication for Critical Function vulnerability…8.6
• CVE-2021-33883A Cleartext Transmission of Sensitive Information vulnerabil…7.5
• CVE-2021-33884An Unrestricted Upload of File with Dangerous Type vulnerabi…9.1
• CVE-2021-33885An Insufficient Verification of Data Authenticity vulnerabil…9.8
• CVE-2021-33886An improper sanitization of input vulnerability in B. Braun …8.8
• CVE-2021-33887Insufficient verification of data authenticity in Peloton TT…6.8