CVE-2019-14359

Severity Score

2.4

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover a data value. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is no security impact: the only potentially leaked information is the number of characters in the PIN

** EN DISPUTA ** En los dispositivos BC Vault, se encontró un canal lateral para la pantalla OLED SSD1309 basada en filas. El consumo de energía de cada ciclo de visualización basado en filas depende del número de píxeles iluminados, lo que permite una recuperación parcial del contenido de la pantalla. Por ejemplo, un implante de hardware en el cable USB podría aprovechar este comportamiento para recuperar un valor de datos. En otras palabras, el canal lateral es relevante solo si el atacante tiene suficiente control sobre la conexión USB del dispositivo para realizar mediciones de consumo de energía en un momento en que se muestran datos secretos. El canal lateral no es relevante en otras circunstancias, como un dispositivo robado que actualmente no muestra datos secretos. NOTA: la posición del proveedor es que no hay impacto en la seguridad: la única información potencialmente filtrada es la cantidad de caracteres en el PIN.

*Credits: N/A

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-07-28 CVE Reserved
2019-08-12 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
2024-08-05 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-203: Observable Discrepancy

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://bc-vault.com/2019/08/our-response-to-cve-2019-14359	2024-08-05

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Real-sec Search vendor "Real-sec"	Bc Vault Firmware Search vendor "Real-sec" for product "Bc Vault Firmware"	-	-	Affected	in	Real-sec Search vendor "Real-sec"	Bc Vault Search vendor "Real-sec" for product "Bc Vault"	-	-	Safe