6.9

CVE-2022-30330

Exploit
In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Keepkey ≫ Keepkey Firmware Version < 7.3.2
   Keepkey ≫ Keepkey Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.53% 0.403
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.6 0.7 5.9
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://blog.inhq.net/posts/keepkey-CVE-2022-30330/
Patch
Third Party Advisory
Exploit
https://github.com/keepkey/keepkey-firmware/commit/447c1f038a31378ab9589965c098467d9ea6cccc
Patch
Third Party Advisory
https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2
Third Party Advisory
Release Notes