CVE-2019-18672

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-03-02T14:03:52.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-18672", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065", "refsource": "MISC", "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"}, {"name": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680", "refsource": "MISC", "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"}, {"name": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3", "refsource": "CONFIRM", "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"}, {"name": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/", "refsource": "MISC", "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:54:14.478Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-18672", "datePublished": "2019-12-06T17:54:54.000Z", "dateReserved": "2019-11-02T00:00:00.000Z", "dateUpdated": "2024-08-05T01:54:14.478Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:shapeshift:keepkey_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2E31C0B-7A1C-463C-B8ED-942F7C7BC9E3", "versionEndExcluding": "6.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:shapeshift:keepkey_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "C96080B0-34F6-45C3-B3A1-6B029B62A118", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB."}, {"lang": "es", "value": "Las comprobaciones insuficientes en la m\u00e1quina de estados finitos de la billetera de hardware ShapeShift KeepKey versiones de firmware anteriores a 6.2.2, permiten un restablecimiento parcial de los secretos criptogr\u00e1ficos a valores conocidos por medio de mensajes dise\u00f1ados. En particular, esto rompe la seguridad de U2F para nuevos registros del servidor e invalida los registros existentes. Esta vulnerabilidad puede ser explotada por atacantes no autenticados y la interfaz es accesible por medio de WebUSB."}], "id": "CVE-2019-18672", "lastModified": "2026-06-17T02:25:16.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-06T18:15:12.700", "references": [{"source": "cve@mitre.org", "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}