CVE-2018-9119

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-91205.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.CVE-2018-91215.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.CVE-2018-91225.4In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.CVE-2018-91235.4In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.CVE-2018-91269.8The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover databa CVE-2018-91279.8Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames w CVE-2018-91287.8DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.CVE-2018-91295.9ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for I CVE-2018-91306.1IBOS 4.4.3 has XSS via a company full name.CVE-2018-91326.5libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerabil CVE-2018-91336.5ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang CVE-2018-91348.8file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup