Sign-up

ID

VAR-201912-0655


CVE

CVE-2019-12503


TITLE

Inateck BCST-60 Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013244

DESCRIPTION

Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. Inateck BCST-60 Contains an injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Inateck BCST-60 is a barcode scanner that can be used wirelessly using a 2.4 GHz radio communication or a wired connection via USB. Advisory ID: SYSS-2019-027 Product: BCST-60 Barcode Scanner Manufacturer: Inateck Affected Version(s): BCST-60 Tested Version(s): BCST-60 Vulnerability Type: Cryptographic Issues (CWE-310) Keystroke Injection Vulnerability Risk Level: High Solution Status: Open Manufacturer Notification: 2019-05-22 Solution Date: - Public Disclosure: 2019-11-28 CVE Reference: CVE-2019-12503 Author of Advisory: Matthias Deeg (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Inateck BCST-60 is a barcode scanner that can be either used wirelessly using 2.4 GHz radio communication or wired via USB. The manufacturer describes the product as follows [1]: "With a 2.4G wireless connection, avoid the troubles of Bluetooth pairing. Inateck BCST-60 is a leading product among scanners in the field of large transmission ranges and battery endurance. What's more, it can read barcodes at extreme angles. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): SySS GmbH could successfully perform keystroke injection attacks against the wireless barcode scanner Inateck BCST-60 using a developed proof-of-concept software tool in combination with the USB radio dongle Crazyradio PA and the nrf-research-firmware by Marc Newlin [2, 3]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a solution for this reported security vulnerability. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2019-05-22: Vulnerability reported to manufacturer 2019-11-28: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Inateck BCST-60 barcode scanner https://www.inateck.com/bcst-60-2-4ghz-wireless-barcode-scanner-with-35m-range.html [2] Product website for Crazyradio PA https://www.bitcraze.io/crazyradio-pa/ [3] nRF24 research firmware and tools by Marc Newlin https://github.com/marcnewlin/presentation-clickers [4] SySS Security Advisory SYSS-2019-027 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-027.txt [5] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en

Trust: 2.25

sources: NVD: CVE-2019-12503 // JVNDB: JVNDB-2019-013244 // CNVD: CNVD-2019-46106 // PACKETSTORM: 155503

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-46106

AFFECTED PRODUCTS

vendor:inateckmodel:bcst-60scope:eqversion: -

Trust: 1.0

vendor:inateckmodel:bcst-60scope: - version: -

Trust: 0.8

vendor:inateckmodel:technology bcst-60 barcode scannerscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2019-46106 // JVNDB: JVNDB-2019-013244 // NVD: CVE-2019-12503

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-12503
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-12503
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2019-46106
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201911-1501
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-12503
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-46106
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-12503
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-12503
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2019-46106 // JVNDB: JVNDB-2019-013244 // CNNVD: CNNVD-201911-1501 // NVD: CVE-2019-12503

PROBLEMTYPE DATA

problemtype:CWE-319

Trust: 1.0

problemtype:CWE-306

Trust: 1.0

problemtype:CWE-74

Trust: 0.8

sources: JVNDB: JVNDB-2019-013244 // NVD: CVE-2019-12503

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1501

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201911-1501

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-013244

PATCH
title:BCST-60 2.4GHz Wireless Barcode Scanner with 35m Rangeurl:https://www.inateck.com/bcst-60-2-4ghz-wireless-barcode-scanner-with-35m-range.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2019-013244

EXTERNAL IDS
db:PACKETSTORMid:155503
Trust: 3.1
db:NVDid:CVE-2019-12503
Trust: 3.1
db:JVNDBid:JVNDB-2019-013244
Trust: 0.8
db:CNVDid:CNVD-2019-46106
Trust: 0.6
db:CNNVDid:CNNVD-201911-1501
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-46106 // 
            
            
            
            JVNDB: JVNDB-2019-013244 // 
            
            
            
            PACKETSTORM: 155503 // 
            
            
            
            CNNVD: CNNVD-201911-1501 // 
            
            
            
            NVD: CVE-2019-12503

REFERENCES
url:http://packetstormsecurity.com/files/155503/inateck-bcst-60-barcode-scanner-keystroke-injection.html
Trust: 3.6
url:http://seclists.org/fulldisclosure/2019/nov/30
Trust: 2.2
url:https://www.syss.de/fileadmin/dokumente/publikationen/advisories/syss-2019-027.txt
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-12503
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12503
Trust: 0.8
url:http://creativecommons.org/licenses/by/3.0/deed.en
Trust: 0.1
url:https://www.syss.de/fileadmin/dokumente/pgpkeys/matthias_deeg.asc
Trust: 0.1
url:https://www.syss.de/en/responsible-disclosure-policy/
Trust: 0.1
url:https://github.com/marcnewlin/presentation-clickers
Trust: 0.1
url:https://www.inateck.com/bcst-60-2-4ghz-wireless-barcode-scanner-with-35m-range.html
Trust: 0.1
url:https://www.bitcraze.io/crazyradio-pa/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-46106 // 
            
            
            
            JVNDB: JVNDB-2019-013244 // 
            
            
            
            PACKETSTORM: 155503 // 
            
            
            
            CNNVD: CNNVD-201911-1501 // 
            
            
            
            NVD: CVE-2019-12503

CREDITS
Matthias Deeg
Trust: 0.7
sources:
            
            
            PACKETSTORM: 155503 // 
            
            
            
            CNNVD: CNNVD-201911-1501

SOURCES
db:CNVDid:CNVD-2019-46106
db:JVNDBid:JVNDB-2019-013244
db:PACKETSTORMid:155503
db:CNNVDid:CNNVD-201911-1501
db:NVDid:CVE-2019-12503

LAST UPDATE DATE
2024-11-23T23:04:35.103000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-46106date:2019-12-18T00:00:00
db:JVNDBid:JVNDB-2019-013244date:2019-12-23T00:00:00
db:CNNVDid:CNNVD-201911-1501date:2020-10-28T00:00:00
db:NVDid:CVE-2019-12503date:2024-11-21T04:22:59.283

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-46106date:2019-12-18T00:00:00
db:JVNDBid:JVNDB-2019-013244date:2019-12-23T00:00:00
db:PACKETSTORMid:155503date:2019-11-30T22:33:36
db:CNNVDid:CNNVD-201911-1501date:2019-11-30T00:00:00
db:NVDid:CVE-2019-12503date:2019-12-02T17:15:12.123