CVE-2019-18672

CVE-2019-18672 describes an insufficient checks vulnerability in ShapeShift KeepKey hardware wallet firmware versions prior to 6.2.2. This flaw allows unauthenticated attackers to partially reset cryptographic secrets to known values through crafted messages, specifically impacting U2F security for new and existing server registrations. With a CVSS score of 7.5 (HIGH), the vulnerability is network-exploitable with low attack complexity, leading to high integrity impact. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.