CVE-2019-12503

An attacker captures and analyzes the unencrypted 2.4 GHz radio packets exchanged between the barcode scanner and its USB receiver to reverse-engineer the protocol [ref_id=1]. Using a compatible radio dongle (e.g., Crazyradio PA with nrf-research-firmware), the attacker then crafts and transmits arbitrary keystroke packets to the victim's USB receiver [ref_id=1]. No authentication or encryption protects the data communication, so the receiver accepts these injected packets as legitimate scanner input [CWE-310]. The attack can be performed remotely when the target system is unattended, allowing the attacker to install malware or take control of the victim's computer [ref_id=1].

The advisory does not identify specific functions, files, or code paths. The vulnerability lies in the unencrypted and unauthenticated 2.4 GHz radio communication protocol used between the wireless barcode scanner (Inateck BCST-60) and its USB dongle receiver.

No patch or fix has been published by the manufacturer. The advisory states that the solution status is "Open" and that SySS GmbH is not aware of a solution for this reported security vulnerability [ref_id=1]. To remediate the issue, the wireless communication protocol would need to implement encryption and authentication to prevent unauthorized devices from injecting keystroke packets into the receiver.