CVE-2019-16398

MEDIUM

Keeper K5 <20.1.0.25-20.1.0.63 - RCE

Title source: llm

Description

On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes a reverse shell.

Exploits (1)

gitlab WORKING POC

by crypt0crc · poc

https://gitlab.com/crypt0crc/cve-2019-16398

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory] https://gitlab.com/crypt0crc/cve-2019-16398

Scores

CVSS v3 6.8

EPSS 0.0016

EPSS Percentile 36.8%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-345

Status published

Products (2)

keeper/k5_firmware 20.1.0.25

keeper/k5_firmware 20.1.0.63

Published Sep 19, 2019

Tracked Since Feb 18, 2026