Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-6257

The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."

Published

2016-08-02T14:59:04.490

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

6.5

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-310
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System amazonbasics firmware - Yes
Hardware amazonbasics usb_dongle - No
Hardware amazonbasics wireless_keyboard - No
Operating System dell km714_firmware ≤ 012.005.00028 Yes
Hardware dell km714_dongle - No
Hardware dell km714_wireless_keyboard - No
Operating System dell km632_firmware - Yes
Hardware dell km632_dongle - No
Hardware dell km632_wireless_keyboard - No
Operating System logitech unifying_firmware ≤ 012.005.00028 Yes
Operating System logitech unifying_firmware ≤ 024.003.00027 Yes
Hardware logitech unifying_dongle - No
Operating System lenovo ultraslim_firmware - Yes
Hardware lenovo ultraslim_dongle - No
Hardware lenovo ultraslim_wireless_keyboard - No
References