{"api_version":"1","generated_at":"2026-07-23T12:02:38+00:00","cve":"CVE-2018-9119","urls":{"html":"https://cve.report/CVE-2018-9119","api":"https://cve.report/api/cve/CVE-2018-9119.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-9119","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-9119"},"summary":{"title":"CVE-2018-9119","description":"An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-04-04 18:29:00","updated_at":"2023-08-31 23:15:00"},"problem_types":["CWE-306"],"metrics":[],"references":[{"url":"https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html","name":"https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html","refsource":"MISC","tags":["Third Party Advisory"],"title":"ICE9 Blog: Stealing Credit Cards from FUZE via Bluetooth","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/","name":"https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/","refsource":"MISC","tags":["Issue Tracking"],"title":"reddit: the front page of the internet","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://ice9.us/advisories/ICE9-2018-001.txt","name":"https://ice9.us/advisories/ICE9-2018-001.txt","refsource":"MISC","tags":["Third Party Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.elttam.com/blog/fuzereview/#content","name":"https://www.elttam.com/blog/fuzereview/#content","refsource":"MISC","tags":[],"title":"Fuze Multi-Card Technology Security Review","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9119","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9119","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"9119","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"brilliantts","cpe5":"fuze_card","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"9119","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"brilliantts","cpe5":"fuze_card","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"9119","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"brilliantts","cpe5":"fuze_card_ble_firmware","cpe6":"0.7.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"9119","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"brilliantts","cpe5":"fuze_card_ble_firmware","cpe6":"0.7.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"9119","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"brilliantts","cpe5":"fuze_card_mcu_firmware","cpe6":"0.1.73","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"9119","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"brilliantts","cpe5":"fuze_card_mcu_firmware","cpe6":"0.1.73","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-9119","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/","refsource":"MISC","url":"https://www.reddit.com/r/netsec/comments/89qrp1/stealing_credit_cards_from_fuze_via_bluetooth/"},{"name":"https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html","refsource":"MISC","url":"https://blog.ice9.us/2018/04/stealing-credit-cards-from-fuze-bluetooth.html"},{"name":"https://ice9.us/advisories/ICE9-2018-001.txt","refsource":"MISC","url":"https://ice9.us/advisories/ICE9-2018-001.txt"},{"refsource":"MISC","name":"https://www.elttam.com/blog/fuzereview/#content","url":"https://www.elttam.com/blog/fuzereview/#content"}]}},"nvd":{"publishedDate":"2018-04-04 18:29:00","lastModifiedDate":"2023-08-31 23:15:00","problem_types":["CWE-306"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.9,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.6},"severity":"LOW","exploitabilityScore":3.9,"impactScore":4.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:brilliantts:fuze_card_ble_firmware:0.7.4:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:brilliantts:fuze_card_mcu_firmware:0.1.73:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:h:brilliantts:fuze_card:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"9119","Ordinal":"125510","Title":"CVE-2018-9119","CVE":"CVE-2018-9119","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"9119","Ordinal":"1","NoteData":"An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"9119","Ordinal":"2","NoteData":"2018-04-04","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"9119","Ordinal":"3","NoteData":"2018-04-04","Type":"Other","Title":"Modified"}]}}}