CVE-2018-9119

An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.

• CWE-306

• https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.htmlThird Party Advisory
• https://ice9.us/advisories/ICE9-2018-001.txtThird Party Advisory
• https://www.elttam.com/blog/fuzereview/#content
• https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/Issue Tracking
• https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.htmlThird Party Advisory
• https://ice9.us/advisories/ICE9-2018-001.txtThird Party Advisory
• https://www.elttam.com/blog/fuzereview/#content
• https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/Issue Tracking

Published

Apr 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9112A low privileged admin account with a weak default password …
• CVE-2018-9113Centers for Disease Control and Prevention MicrobeTRACE 0.1.…
• CVE-2018-9115Systematic SitaWare 6.4 SP2 does not validate input from oth…
• CVE-2018-9116An XXE vulnerability within WireMock before 2.16.0 allows a …
• CVE-2018-9117WireMock before 2.16.0 contains a vulnerability that allows …
• CVE-2018-9118exports/download.php in the 99 Robots WP Background Takeover…
• CVE-2018-9120In Crea8social 2018.2, there is Stored Cross-Site Scripting …
• CVE-2018-9121In Crea8social 2018.2, there is Stored Cross-Site Scripting …
• CVE-2018-9122In Crea8social 2018.2, there is Reflected Cross-Site Scripti…
• CVE-2018-9123In Crea8social 2018.2, there is Stored Cross-Site Scripting …
• CVE-2018-9126The DNNArticle module 11 for DNN (formerly DotNetNuke) allow…
• CVE-2018-9127Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wild…