GCVE - cpe:2.3:h:keepkey:keepkey:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:keepkey:keepkey:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Keepkey (`68f4975b-1ab5-52dd-a2be-9993f6f591e7`)
Product	Keepkey (`af540ab6-4caa-54a0-b3f9-18e328418ff5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-30330`	not_vulnerable	2026-06-08 05:43:37.961338	Details available In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes. Published: 2022-05-07T03:25:34.000Z Updated: 2024-08-03T06:48:35.769Z Open on db.gcve.eu Reference links https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2 https://github.com/keepkey/keepkey-firmware/commit/447c1f038a31378ab9589965c098467d9ea6cccc https://blog.inhq.net/posts/keepkey-CVE-2022-30330/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-18671`	not_vulnerable	2026-06-08 05:13:12.066487	Details available Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB. Published: 2019-12-06T17:53:29.000Z Updated: 2024-08-05T01:54:14.598Z Open on db.gcve.eu Reference links https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3 https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 https://blog.inhq.net/posts/keepkey-CVE-2019-18671/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6875`	not_vulnerable	2026-06-08 05:11:54.348519	Details available Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be accessible), related to text containing characters that the device's font lacks. Published: 2018-03-14T13:00:00.000Z Updated: 2024-08-05T06:17:16.728Z Open on db.gcve.eu Reference links https://www.keepkey.com/2018/03/09/security-updates-responsible-disclosure/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.