CVE-2016-6257

The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."

• CWE-310

• http://www.securityfocus.com/bid/92179Third Party Advisory, VDB Entry
• https://github.com/BastilleResearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txtThird Party Advisory
• https://support.lenovo.com/product_security/len_7267Vendor Advisory
• https://www.bastille.net/research/vulnerabilities/keyjackThird Party Advisory
• http://www.securityfocus.com/bid/92179Third Party Advisory, VDB Entry
• https://github.com/BastilleResearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txtThird Party Advisory
• https://support.lenovo.com/product_security/len_7267Vendor Advisory
• https://www.bastille.net/research/vulnerabilities/keyjackThird Party Advisory

Published

Aug 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6251Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-6252Integer overflow in shadow 4.2.1 allows local users to gain …
• CVE-2016-6253mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through…
• CVE-2016-6254Heap-based buffer overflow in the parse_packet function in n…
• CVE-2016-6255Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote …
• CVE-2016-6256SAP Business One for Android 1.2.3 allows remote attackers t…
• CVE-2016-6258The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earl…
• CVE-2016-6259Xen 4.5.x through 4.7.x do not implement Supervisor Mode Acc…
• CVE-2016-6261The idna_to_ascii_4i function in lib/idna.c in libidn before…
• CVE-2016-6262idn in libidn before 1.33 might allow remote attackers to ob…
• CVE-2016-6263The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in…
• CVE-2016-6264Integer signedness error in libc/string/arm/memset.S in uCli…7.5