PT-2018-6259 · Meco · Meco Usb Memory Stick With Fingerprint Mecoziolsamde601

Elie Bursztein + 2 · Published 2018-03-22 · Updated 2019-10-03 · CVE-2017-16242

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: MECO USB Memory Stick with Fingerprint MECOZiolsamDE601

Description: An issue allows the fingerprint authentication requirement for data access to be bypassed. With physical access, an attacker can send a static packet to a serial port exposed on the PCB to unlock the key and access the data without the required fingerprint.

Recommendations: For MECO USB Memory Stick with Fingerprint MECOZiolsamDE601, as a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-16242

Affected Products

Meco Usb Memory Stick With Fingerprint Mecoziolsamde601

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-16242 · Security Note
• https://blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443 · Note
• https://blackhat.com/docs/us-17/thursday/us-17-Picod-Attacking-Encrypted-USB-Keys-The-Hard%28ware%29-Way.pdf · Note
• https://gist.github.com/audebert/ef6e206a27ededd1386cff48604e9335 · Note
• https://elie.net/talk/attacking-encrypted-usb-keys-the-hardware-way · Note