CVE-2019-18673

On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. Note: BIP39 secrets are not displayed by default on this device. The side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.

• CWE-203

• https://blog.inhq.net/posts/oled-side-channel-status-summary/Exploit, Third Party Advisory
• https://blog.inhq.net/posts/oled-side-channel-status-summary/Exploit, Third Party Advisory

Published

Nov 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18667/usr/local/www/freeradius_view_config.php in the freeradius3…6.1
• CVE-2019-18668An issue was discovered in the Currency Switcher addon befor…6.5
• CVE-2019-1867A vulnerability in the REST API of Cisco Elastic Services Co…10
• CVE-2019-18670In the Quick Access Service (QAAdminAgent.exe) in Acer Quick…7.8
• CVE-2019-18671Insufficient checks in the USB packet handling of the ShapeS…9.8
• CVE-2019-18672Insufficient checks in the finite state machine of the Shape…7.5
• CVE-2019-18674An issue was discovered in Joomla! before 3.9.13. A missing …5.3
• CVE-2019-18675The Linux kernel through 5.3.13 has a start_offset+size Inte…7.8
• CVE-2019-18676An issue was discovered in Squid 3.x and 4.x through 4.8. Du…7.5
• CVE-2019-18677An issue was discovered in Squid 3.x and 4.x through 4.8 whe…6.1
• CVE-2019-18678An issue was discovered in Squid 3.x and 4.x through 4.8. It…5.3
• CVE-2019-18679An issue was discovered in Squid 2.x, 3.x, and 4.x through 4…7.5