CVE-2019-18671

moderate-risk
Published 2019-12-06

Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB.

Do I need to act?

~
5.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Keepkey Firmware

Affected Vendors

Keepkey

References (8)

https://blog.inhq.net/posts/keepkey-CVE-2019-18671/
Patch https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba6150...
Release Notes https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
Third Party Advisory https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
https://blog.inhq.net/posts/keepkey-CVE-2019-18671/
Patch https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba6150...
Release Notes https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
Third Party Advisory https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
46
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 9/34 · Low
Exposure 5/34 · Minimal