CVE-2019-18672

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets…

published December 6, 2019

CVSS
—
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00783 · 55.5th percentile
Published
2019-12-06T17:54Z
EPSS history
Timeline
  • 06 DEC 17:54Z
    Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets…
    cvelistv5