CVEvulnerability

CVE-2023-27892

5.7 MEDIUM Published 2023-05-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-05-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.8 LOW — CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-120, CWE-125

Description

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.

Affected configurations

• shapeshift keepkey firmware (>= 7.5.2 < 7.7.0)

Related

Weakness · CWE (2)

  • CWE-120 Buffer Copy without Checking Size of Input weakness
  • CWE-125 Out-of-bounds Read weakness

References