CVEvulnerability
CVE-2019-18672
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-12-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-354
Description
Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.
Affected configurations
• shapeshift keepkey firmware (< 6.2.2)
Related
Weakness · CWE (1)
- CWE-354 Improper Validation of Integrity Check Value weakness
References
- https://blog.inhq.net/posts/keepkey-CVE-2019-18672/ blog.inhq.net
- https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680 Patch, Third Party Advisory
- https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 Third Party Advisory
- https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 Third Party Advisory
- https://blog.inhq.net/posts/keepkey-CVE-2019-18672/ blog.inhq.net
- https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680 Patch, Third Party Advisory
- https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 Third Party Advisory
- https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 Third Party Advisory