CVE-2019-9835

The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.

CVSS v3 9.6 CRITICAL
CVSS v2.0 5.8 MEDIUM

9.6^/10

CVSS v3 : CRITICAL

Vector : AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 6.5 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/107440
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt	Exploit Third Party Advisory
http://www.securityfocus.com/bid/107440
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fujitsu:lx901_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:lx901:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:fujitsu:gk900_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gk900:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-15 18:29

Updated : 2024-11-21 04:52

NVD link : CVE-2019-9835

Mitre link : CVE-2019-9835

CVE.ORG link : CVE-2019-9835

JSON object : View

Products Affected

fujitsu

gk900_firmware
lx901_firmware
lx901
gk900

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-9835", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "published": "2019-03-15T18:29:00.750", "references": [{"url": "http://www.securityfocus.com/bid/107440", "source": "cve@mitre.org"}, {"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/107440", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption."}, {"lang": "es", "value": "El componente del recibidor (tambi\u00e9n conocido como bridge) de los dispositivos Fujitsu Wireless Keyboard Set LX901 y GK900 permite la inyecci\u00f3n de pulsaciones de tecla. Esto ocurre porque acepta paquetes de 2.4 GHz sin cifrar, incluso aunque todas las comunicaciones leg\u00edtimas emplean el cifrado AES."}], "lastModified": "2024-11-21T04:52:24.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lx901_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CEC1951-A461-4F87-9C94-019B3F4B87E5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lx901:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FE80A378-5919-4C19-8881-454E4BF4A208"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:gk900_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF659B0E-33A5-490F-B96F-9420EB68B850"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:gk900:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8652EE2E-461D-4007-86BB-F3BCA215AF20"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}