On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found.
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-203.
Summary
On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is "insignificant risk.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:shapeshift:keepkey_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Shapeshift |
| cpe:2.3:h:shapeshift:keepkey:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Shapeshift |
- cpe:2.3:o:shapeshift:keepkey_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Shapeshift
- cpe:2.3:h:shapeshift:keepkey:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Shapeshift
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14355
- 2026-10-03 Alias added: GHSA-xr2p-42gc-m46q
References
More Shapeshift Keepkey Firmware vulnerabilities
- TI-2023-12483 Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before… CVSS 3.1MEDIUM 5.7
- TI-2021-11714 Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before… CVSS 3.1HIGH 8.8
- TI-2018-05022 Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger… CVSS 3.0HIGH 7.5
- TI-2019-13510 Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-14355 · CVE Program
- CVE-2019-14355 · NVD
- FIRST EPSS
- GHSA-xr2p-42gc-m46q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences