#VU21235 Input validation error in Keeper K5 - CVE-2019-16398

Vulnerability identifier: #VU21235

Vulnerability risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-16398

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Keeper K5
Hardware solutions / Security hardware applicances

Vendor: Keeper

Description

The vulnerability allows a local attacker to execute arbitrary code on the target device.

The vulnerability exists due to insufficient validation of user-supplied input. An attacker with physical access to the device can insert an SD card containing a file named "zskj_script_run.sh" that executes arbitrary code.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Keeper K5: 20.1.0.25 - 20.1.0.63

---

External links
https://gitlab.com/crypt0crc/cve-2019-16398
https://www.youtube.com/watch?v=S_cTme7m8Ng&feature=youtu.be

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.