CVE-2019-14357

On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that an attack is not "realistically implementable.

• CWE-203

• https://github.com/limpkin/mooltipass/blob/master/CVE-2019-14357_statement.mdThird Party Advisory
• https://github.com/limpkin/mooltipass/blob/master/CVE-2019-14357_statement.mdThird Party Advisory

Published

Aug 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14351EspoCRM 5.6.4 is vulnerable to user password hash enumeratio…
• CVE-2019-14352In Joget Workflow 6.0.20, CSV Injection, also known as Formu…
• CVE-2019-14353On Trezor One devices before 1.8.2, a side channel for the r…
• CVE-2019-14354On Ledger Nano S and Nano X devices, a side channel for the …
• CVE-2019-14355On ShapeShift KeepKey devices, a side channel for the row-ba…
• CVE-2019-14356On Coldcard MK1 and MK2 devices, a side channel for the row-…5.3
• CVE-2019-14358On Archos Safe-T devices, a side channel for the row-based O…4.6
• CVE-2019-14359On BC Vault devices, a side channel for the row-based SSD130…
• CVE-2019-1436An information disclosure vulnerability exists when the win3…5.5
• CVE-2019-14360On Hyundai Pay Kasse HK-1000 devices, a side channel for the…4.6
• CVE-2019-14361Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14362Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Tr…