CVE-2019-18672 - Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages

Back Back to CVE browser

HIGH

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages

Published Dec 6, 2019

7.5

HIGH

CVSS 3.1

EPSS 0.78%

Description

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-354

References (4)

https://blog.inhq.net/posts/keepkey-CVE-2019-18672/
x_refsource_MISC
https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680
x_refsource_MISCPatchThird Party Advisory
https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
x_refsource_MISCThird Party Advisory
https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://blog.inhq.net/posts/keepkey-CVE-2019-18672/		x_refsource_MISC
https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680		x_refsource_MISCPatchThird Party Advisory
https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065		x_refsource_MISCThird Party Advisory
https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3		x_refsource_CONFIRMThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 6, 2019

Updated Aug 5, 2024

Reserved Nov 2, 2019

Link CVE-2019-18672

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-18672

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-18672