CVE-2023-27892

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.

CVSS v3.1

5.7 MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

CVSS v3.1

3.8 LOWCVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.47% chance of exploitation in the next 30 days, 39th percentile

Published

2023-05-02

Updated

2025-01-30

Proof-of-concept exploits (1)

• https://blog.inhq.net/posts/keepkey-CVE-2023-27892/

References

• CVE Record
• NVD entry

Related

• CVE-2023-2789
• CVE-2023-2790
• CVE-2023-27882
• CVE-2023-27922
• CVE-2023-27856
• CVE-2023-2795