Updated October 2026. This article replaces an earlier version and summarises published guidance from HID Global and CISA.
The short answer
HID iClass SE and Seos are far more secure than the 125 kHz proximity fobs and legacy iClass cards still found in many Australian buildings. The weak point is usually not the Seos credential itself but how the readers are set up. Readers left in migration mode, still accepting older card types, can be tricked by a copied legacy card. This is called a downgrade attack.
How a downgrade attack works
According to the CISA advisory ICSA-24-037-01, reading the access data from a Seos or DESFire credential is not enough to clone it, because these technologies use a credential key for authentication. However, if a system’s readers still support legacy technologies such as HID Prox or MIFARE Classic, the same data can be written to a legacy credential that those readers accept.
HID describes the same risk in HID: Safeguarding Against Legacy Downgrade Attacks. Its PACS Security Guidelines recommend disabling legacy credentials once a changeover is complete (see this summary of HID’s PACS Security Guidelines).
The 2024 iCLASS SE encoder vulnerability
In February 2024 HID and CISA disclosed CVE-2024-22388. It affected iCLASS SE readers, reader modules, processors, the CP1000 encoder and several OMNIKEY readers when configured as encoders. Data exposed when reader configuration cards were programmed could include credential and device administration keys. CISA rated it CVSS 5.9: it needs physical proximity to the configuration cards and is not remotely exploitable (CISA advisory ICSA-24-037-01).
What strata committees should ask their installer
- Are our readers in migration mode? If the changeover from old fobs is finished, legacy technologies should be switched off.
- Which key do we use? HID standard keys are shared widely. HID has offered Elite Key upgrades to sites concerned their keys may be exposed.
- Where are the reader configuration cards? HID advises locking reader configuration (firmware 8.6.04 or later with HID Reader Manager, or a Shield Card for some models) and then destroying the configuration cards.
- Is the reader to controller link encrypted? Wiegand wiring is unencrypted. OSDP with Secure Channel, with non-default keys, is the safer option.
- Who controls credential supply? If only the installer can order fobs, the building pays their price and cannot verify how many credentials exist.
When an upgrade makes more sense
If the readers cannot be locked down, the keys are unknown or the committee wants control of its own credentials, replacing the readers is often simpler than securing the existing system. STid Architect Blue readers can read existing cards during a changeover and then run STid Mobile ID virtual cards only, with the strata issuing and revoking credentials itself.
Read more: HID iClass SR cloning risk and fix · upgrading from HID to STid · key fob copying in Australia.
Frequently asked questions
Can HID Seos cards be cloned?
Reading the access data from a Seos or DESFire credential is not enough to copy it, because these technologies authenticate with a credential key. The practical risk is a downgrade attack: if the building’s readers still accept older technologies such as HID Prox, MIFARE Classic or legacy iClass, a copy written to one of those older cards may be accepted.
What is migration mode?
Migration mode lets a reader accept both new and legacy credentials so a building can change over gradually. HID recommends disabling legacy credentials once the changeover is complete, because leaving them enabled makes downgrade attacks possible.
What was CVE-2024-22388?
A vulnerability disclosed in February 2024 affecting HID iCLASS SE readers, encoders and some OMNIKEY readers when configured as encoders. It could expose credential and device administration keys from reader configuration cards. HID advised protecting configuration cards, considering new keys, disabling legacy technologies and locking reader configuration.
Should our strata replace iClass SE readers?
Not always. If the readers can be locked to secure credentials only, their keys are controlled and the firmware is current, they may be kept. Many committees still choose STid mobile access because it also ends installer lock-in and adds phone, lift and car park access.