PT-2019-12833 · Inateck · Inateck Wp1001

Published 2019-06-07 · Updated 2020-08-24 · CVE-2019-12505

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inateck WP1001 version 1.3C

Description The issue allows for keystroke injection attacks due to unencrypted and unauthenticated data communication. This enables an attacker to send arbitrary keystrokes to a victim's computer system, potentially installing malware on an unattended target system. As a result, an attacker can remotely take control of the victim's computer that is operated with an affected receiver of this device.

Recommendations For Inateck WP1001 version 1.3C, consider disabling the device until a patch or secure alternative is available to prevent keystroke injection attacks. Restrict access to sensitive systems and data when using the affected device to minimize the risk of exploitation.

Fix

Missing Authentication

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-306

CWE-319

Related Identifiers

CVE-2019-12505

Affected Products

Inateck Wp1001

References · 6

• https://osv.dev/vulnerability/CVE-2019-12505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12505 · Security Note
• http://seclists.org/fulldisclosure/2019/Jun/4 · Note
• http://packetstormsecurity.com/files/153184/Inateck-2.4-GHz-Wireless-Presenter-WP1001-Keystroke-Injection.html · Note
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-007.txt · Note
• https://seclists.org/bugtraq/2019/Jun/2 · Note