CVE-2016-6257: Medium severity amazon basics usb dongle vulnerability
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6257?
CVE-2016-6257 is classified as a medium severity vulnerability due to the potential for remote keyboard input injection.
How do I fix CVE-2016-6257?
To fix CVE-2016-6257, you should update the firmware for your affected Lenovo Ultraslim dongles and keyboards.
Which products are affected by CVE-2016-6257?
CVE-2016-6257 affects Lenovo Ultraslim dongles used with specific models of keyboards and mice including certain Liteon models.
Can CVE-2016-6257 be exploited remotely?
Yes, CVE-2016-6257 can be exploited remotely, allowing attackers to inject commands through the compromised keyboard.
Is there a workaround for CVE-2016-6257?
As a workaround for CVE-2016-6257, users should avoid using affected devices until updates are applied.