CVE-2019-18671 json
Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes i…
published 2019-12-06 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8387
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB.
Patch / fix
Exploit prediction
3.27% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3
patch, third-party-advisory
-
medium.com
/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
release-notes, third-party-advisory
-
medium.com
/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
third-party-advisory
- blog.inhq.net /posts/keepkey-CVE-2019-18671/
Sources
- CVE List CVE-2019-18671
- NVD CVE-2019-18671
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.