CVE-2019-18672 Other in n/a
Attackers can reset cryptographic secrets to known values via crafted messages, breaking U2F security for KeepKey hardware wallets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18672?
CVE-2019-18672 is a high-severity vulnerability in n/a, published on 6 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.
Weakness: CWE-354
Which versions are affected by CVE-2019-18672?
It affects 1 product.
Products include Shapeshift Keepkey Firmware.
How do I fix CVE-2019-18672?
No fix has been published for CVE-2019-18672 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-18672 being exploited?
There is no known exploitation of CVE-2019-18672 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8j67-xcfp-jfcp.