CVEvulnerability
CVE-2018-9119
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-04-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 3.6 LOW — AV:L/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-306
Description
An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.
Affected configurations
• brilliantts fuze card ble firmware 0.7.4
• brilliantts fuze card mcu firmware 0.1.73
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html Third Party Advisory
- https://ice9.us/advisories/ICE9-2018-001.txt Third Party Advisory
- https://www.elttam.com/blog/fuzereview/#content www.elttam.com
- https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/ Issue Tracking
- https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html Third Party Advisory
- https://ice9.us/advisories/ICE9-2018-001.txt Third Party Advisory
- https://www.elttam.com/blog/fuzereview/#content www.elttam.com
- https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/ Issue Tracking