CVE-2018-9119 | BDVDB-2026-98914 Detail

Description#

An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/
https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html
https://ice9.us/advisories/ICE9-2018-001.txt
https://www.elttam.com/blog/fuzereview/#content

Exploit#

No public exploit known

History#

Version 12018-04-04Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.