CVE-2021-31616 - CVE House
Back to Database
Status published High CVE-2021-31616

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware...

Vulnerability Description

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-31616

Credits & Attribution

No credits recorded in the NVD database.

References

More from shapeshift

View All →
CVE-2019-18672
Insufficient checks in the finite state machine of the ShapeShift...
High 7.5
CVE-2019-14355
On ShapeShift KeepKey devices, a side channel for the row-based...
Low 2.4
CVE-2018-6875
Format String vulnerability in KeepKey version 4.0.0 allows attackers to...
High 7.5

Affected Vendor

Affected Software

keepkey firmware
Vulnerable Versions:
7.0.3

Timeline

Official Publish: May 6th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.