PT-2019-12831 · Inateck · Inateck Bcst-60

Matthias Deeg · Published 2019-11-30 · Updated 2020-08-24 · CVE-2019-12503

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Inateck BCST-60 (affected versions not specified)

Description The Inateck BCST-60 wireless barcode scanner is prone to keystroke injection attacks due to unencrypted and unauthenticated data communication. This allows an attacker to send arbitrary keystrokes to a victim's computer system, potentially installing malware when the target system is unattended, and enabling remote control over the victim's computer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Missing Authentication

Weakness Enumeration

CWE-319

CWE-306

Related Identifiers

CVE-2019-12503

Affected Products

Inateck Bcst-60

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-12503 · Security Note
• http://seclists.org/fulldisclosure/2019/Nov/30 · Note
• https://t.me/defcon_news/31631 · Telegram Post
• https://t.me/cibsecurity/8436 · Telegram Post
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-027.txt · Note
• http://packetstormsecurity.com/files/155503/Inateck-BCST-60-Barcode-Scanner-Keystroke-Injection.html · Note