RFID security is a critical component of access control and time tracking for companies today. Nevertheless, many existing systems are still based on outdated technologies such as 125 kHz RFID, MIFARE Classic or LEGIC Prime.
These systems are now considered insecure as they do not offer modern encryption or authentication. As a result, RFID cards can be cloned, access manipulated and security gaps exploited.
Companies are therefore faced with the task of modernizing their RFID systems and migrating to secure RFID standards.
Why RFID systems are insecure: 125 kHz, MIFARE Classic and LEGIC Prime
Insecure RFID technologies are in particular 125 kHz, MIFARE Classic and LEGIC Prime, as they do not offer modern encryption and authentication and can therefore be easily cloned.
125 kHz RFID insecure – no encryption, no security
125 kHz RFID systems work with a static ID that is transmitted unencrypted. This means that
- No encryption
- No authentication
- No protection mechanisms against copying
Attackers can clone RFID cards or read signals with little effort. This technology therefore represents a considerable security risk for companies.
MIFARE Classic is insecure
MIFARE Classic was used as the standard for a long time, but is no longer secure. The Crypto1 algorithm used is considered to be completely compromised. Keys can be extracted and cards duplicated. This makes it possible:
- Copy cards
- Manipulate access rights
- Use systems without authorization
LEGIC Prime security – proprietary, but compromised
LEGIC Prime is also an insecure RFID technology. The system is based on a proprietary security approach without modern, open cryptography. Analyses show that cards can be read, emulated and systems replicated. For companies, this means
- Lack of secure authentication
- Manipulable communication
- Potentially complete system bypass
LEGIC Prime, like MIFARE Classic, should therefore be regarded as an outdated and insecure technology.
Real risks of insecure RFID systems in the company
The use of insecure RFID technologies leads to specific security problems:
- Unauthorized access to buildings
- Manipulation of time recording systems
- Security gaps in access control
- Compliance risks and liability issues
RFID security is therefore not just a technical issue, but part of overall corporate security.
Secure RFID standards as a target image
Modern RFID security solutions rely on established mechanisms and strong encryption. Typical secure RFID standards are
- MIFARE DESFire EV2 and EV3
- LEGIC advant
These technologies offer:
- AES encryption
- Secure authentication
- Protection against RFID attacks
- Multi-application capability
This makes access control and time tracking secure and future-proof.
Cyber Resilience Act: New Requirements Effective December 11, 2027
With the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, regulatory requirements for the cybersecurity of networked hardware and software products are increasing. The key provisions of the CRA will take effect on December 11, 2027. Manufacturers must then develop, evaluate, and support products containing digital elements throughout their lifecycle in accordance with, among other things, mandatory cybersecurity requirements.
The CRA generally covers products with digital elements that are directly or indirectly connected to a device or network. Depending on their technical design, components of electronic access control and time-recording systems may therefore also fall within the scope of the CRA, such as networked readers, terminals, controllers, or related software.
For manufacturers, the focus is particularly on assessing cybersecurity risks, secure product design, vulnerability management, and the provision of security updates. In addition, certain reporting requirements for actively exploited vulnerabilities and serious security incidents have been in effect since September 11, 2026.
For companies, this means that when migrating to RFID, they should not focus solely on the identification medium used. What matters most is the overall security architecture, which consists of transponders, readers, communication, controllers, and software. Outdated RFID technologies can be a weak point within the overall solution.
Anyone who is modernizing their RFID infrastructure anyway should therefore check early on whether the components in use will be supported in the long term, receive security updates, and support up-to-date authentication and encryption methods. This will allow the technical migration to proceed with the December 11, 2027 sensibly combine the applicable CRA requirements.
Strategically implementing RFID migration in the company
RFID migration should not be understood as a one-off exchange, but as a structured process.
1. carry out an inventory analysis
Companies should first clarify:
- which RFID technologies are in use,
- which RFID readers can continue to be used and
- Which systems are affected
2. use hybrid infrastructure
Multi-technology readers enable the parallel operation of old and new cards. This reduces risks and prevents operational interruptions during migration.
3. step-by-step replacement of the RFID cards
The exchange can be carried out efficiently:
- Onboarding new employees,
- in the event of card loss or transponder loss and
- as part of planned rollouts
4. improve the security architecture
In the course of migration, companies should also:
- Establish a key management system similar to a key book,
- monitor existing access and unauthorized access attempts and
- Separate applications cleanly
5. avoid typical mistakes during RFID migration
Common problems in projects are
- The continued use of insecure legacy systems,
- Lack of coordination between IT and specialist departments (e.g. HR),
- an unclear target architecture and
- Underestimating the security risks
Improved RFID security and therefore a successful RFID migration therefore requires a clear strategy and objective.
Conclusion: RFID security is becoming increasingly important from both a technical and regulatory perspective
125 kHz RFID, MIFARE Classic, and LEGIC Prime are now considered insecure technologies and should be critically evaluated when modernizing existing systems. Modern RFID standards offer stronger encryption and authentication methods and enable secure access control and time tracking.
With the Cyber Resilience Act, cybersecurity for networked hardware and software products is also gaining in importance. The reporting requirements for certain vulnerabilities and security incidents have been in effect since September 11, 2026; the other key requirements of the CRA will take effect on December 11, 2027. Companies should therefore use planned RFID migrations as an opportunity to future-proof not only individual transponders but the entire security architecture.
ZMI helps companies implement secure RFID solutions and migrate existing systems in a structured manner.
