Vulnerability in Cellebrite Ufed
CVE-2020-14474
The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.025 (84.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2020/Jun/31 (Exploit, Mailing List, Third Party Advisory)
- korelogic.com/Resources/Advisories/KL-001-2020-003.txt (Exploit, Third Party Advisory)
- packetstormsecurity.com/files/158254/Cellebrite-EPR-Decryption-Hardcoded-AES-Ke… (Exploit, VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-14474?
- CVE-2020-14474 is a high-severity vulnerability in Cellebrite Ufed, classified under Use of Hard-coded Credentials. CVSS score: 7.5/10. Published 2020-06-30.
- How severe is CVE-2020-14474?
- High severity. CVSS v3 base score is 7.5 out of 10.