Hyundai Pay Kasse HK-1000 OLED Display information disclosure

Summaryinfo

A vulnerability classified as problematic has been found in Hyundai Pay Kasse HK-1000. This affects an unknown function of the component OLED Display. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2019-14360. The attack may be carried out on the physical device. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Hyundai Pay Kasse HK-1000 (version now known). This affects some unknown processing of the component OLED Display. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.

The weakness was released 11/02/2019. This vulnerability is uniquely identified as CVE-2019-14360 since 07/28/2019. The exploitability is told to be difficult. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Hyundai

Name

• Pay Kasse HK-1000

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion