CVE-2019-12505

An attacker with physical proximity captures the unencrypted 2.4 GHz radio packets sent by the wireless presenter to its receiver, reverse-engineers the protocol, and then injects forged packets that the receiver interprets as legitimate keystrokes [ref_id=1]. Because the data communication lacks both encryption and authentication [CWE-345], the receiver cannot distinguish injected packets from genuine presenter signals. This allows the attacker to send arbitrary keystrokes to the victim's computer, for example to install malware while the system is unattended [ref_id=1].

The advisory does not identify specific functions or files; the vulnerability resides in the unencrypted and unauthenticated 2.4 GHz radio protocol used between the Inateck WP1001 wireless presenter and its USB dongle receiver [ref_id=1].

The advisory states the solution status is "Open" and no solution date was provided by the manufacturer [ref_id=1]. No patch or fix has been published. The recommended remediation would be to implement encryption and mutual authentication in the 2.4 GHz radio protocol so that the receiver only accepts keystroke packets that are cryptographically verified as originating from the genuine presenter [ref_id=1].