search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Multiple wireless keyboard/mouse devices use an unsafe proprietary wireless protocol

Vulnerability Note VU#981271

Original Release Date: 2016-02-24 | Last Revised: 2016-03-01

Overview

Wireless keyboard and mouse devices from multiple vendors use proprietary wireless protocols that are not properly secured.

Description

CWE-311: Missing Encryption of Sensitive Data

Multiple wireless input devices (keyboard and mouse) use a proprietary wireless protocol on the 2.4 GHz ISM band that lacks proper encryption. An attacker within wireless transmission range can inject keystrokes or read keystroke data, or cause the victim's device to pair with a new input device. Wireless range on these models varies but is typically a few meters within a home.

The researchers have released a website as well as advisories with more details.

This vulnerability does not impact Bluetooth devices.

Impact

An attacker within wireless transmission range can inject keystrokes on the victim's device, or cause the victim's device to pair with a new input device.

Solution

Update device firmware

According to the researcher, Logitech has released an updated firmware for their devices to address this issue. Please contact Logitech customer support for more information.

Users of other models should consider individual use cases and threat models when using the devices until an update is available.

Vendor Information

981271
Expand all

Logitech

Updated:  February 26, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Logitech has released an updated firmware and provides instructions for obtaining it at the URL below:

Vendor References

https://forums.logitech.com/t5/Mice-and-Pointing-Devices/Logitech-Response-to-Unifying-Receiver-Research-Findings/td-p/1493878

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Amazon

Updated:  February 24, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Dell

Updated:  February 24, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

HP Inc.

Updated:  February 24, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Lenovo

Updated:  February 24, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Microsoft Corporation

Updated:  February 24, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Tecknet

Notified:  March 01, 2016 Updated:  March 01, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 2.9 AV:A/AC:M/Au:N/C:N/I:P/A:N
Temporal 2.6 E:POC/RL:U/RC:C
Environmental 1.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Marc Newlin of Bastille Threat Research Team for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: None
Date Public: 2016-02-23
Date First Published: 2016-02-24
Date Last Updated: 2016-03-01 22:12 UTC
Document Revision: 30

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.