CVE-2019-18671

State: Published
Severity: Not scored
Published: Dec 6, 2019
Updated: Aug 5, 2024
Reserved: Nov 2, 2019

Description

Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3
https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
https://blog.inhq.net/posts/keepkey-CVE-2019-18671/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.