GCVE - cpe:2.3:o:shapeshift:keepkey_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:shapeshift:keepkey_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Shapeshift (`8952567a-243f-52b4-a5eb-ca24562b2bb0`)
Product	Keepkey Firmware (`eb2b1168-cc32-5404-a403-dac3b320ffdb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/greatwoif/keepkey-firmware`	purl2cpe	2026-06-01 10:11:58.234092
`pkg:github/greatwolf/keepkey-firmware`	purl2cpe	2026-06-01 10:11:58.234094
`pkg:github/keepkey/keepkey-firmware`	purl2cpe	2026-06-01 10:11:58.234095

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-27892`	vulnerable	2026-06-08 05:57:42.423422	Details available LOW (3.8) Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet. Published: 2023-05-02T00:00:00.000Z Updated: 2025-01-30T16:42:38.016Z Open on db.gcve.eu Reference links https://github.com/keepkey/keepkey-firmware/pull/337 https://blog.inhq.net/posts/keepkey-CVE-2023-27892/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-31616`	vulnerable	2026-06-08 05:31:53.776661	Details available Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB. Published: 2021-05-06T11:01:42.000Z Updated: 2024-08-03T23:03:33.671Z Open on db.gcve.eu Reference links https://github.com/keepkey/keepkey-firmware/releases/tag/v7.1.0 https://github.com/keepkey/keepkey-firmware/commit/e49d45594002d4d3fbc1f03488e6dfc0a0a65836 https://blog.inhq.net/posts/keepkey-CVE-2021-31616/ https://shapeshift.com/library/keepkey-important-update-issued-april-4-required	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-18672`	vulnerable	2026-06-08 05:13:12.067927	Details available Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB. Published: 2019-12-06T17:54:54.000Z Updated: 2024-08-05T01:54:14.478Z Open on db.gcve.eu Reference links https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680 https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 https://blog.inhq.net/posts/keepkey-CVE-2019-18672/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.