Is CVE-2019-14355 actively exploited?

No active exploitation of CVE-2019-14355 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-14355 be exploited remotely?

No. CVE-2019-14355 requires physical access to exploit.

What is the CVSS score of CVE-2019-14355?

CVE-2019-14355 has a CVSS score of 2.4 (LOW).

HOME VULNERABILITIESCVE-2019-14355

LOW

CVE-2019-14355

CWE-203Published: August 10, 2019· Updated: Jun 17, 2026

2.4

CVSS v3.1

Official Description

On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is "insignificant risk.

NVD Source

Technical Analysis

CVE-2019-14355 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.