Vulnerabilities > CVE-2016-6257 - Cryptographic Issues vulnerability in multiple products

The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."

Vulnerable Configurations

Part	Description	Count
OS	Amazonbasics Amazonbasics Firmware -	1
OS	Dell Dell Km714 Firmware 012.005.00028 Dell Km632 Firmware -	2
OS	Logitech Logitech Unifying Firmware 012.005.00028 Logitech Unifying Firmware 024.003.00027	2
OS	Lenovo Lenovo Ultraslim Firmware -	1
Hardware	Amazonbasics Amazonbasics USB Dongle - Amazonbasics Wireless Keyboard -	2
Hardware	Dell Dell Km714 Dongle - Dell Km714 Wireless Keyboard - Dell Km632 Dongle - Dell Km632 Wireless Keyboard -	4
Hardware	Logitech Logitech Unifying Dongle -	1
Hardware	Lenovo Lenovo Ultraslim Dongle - Lenovo Ultraslim Wireless Keyboard -	2

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References