Kr00k – CVE-2019-15126

Kr00k – CVE-2019-15126 is a vulnerability that affected billions of devices, potentially causing the leak of sensitive data and opening a new attack vector for blackhats. Following the discovery of the vulnerability, ESET responsibly disclosed it to the affected chip manufacturers Broadcom and Cypress (and, initially, to Amazon). We also contacted ICASI to ensure that the vulnerability would be disclosed to other (possibly) affected parties – device manufacturers using the vulnerable chips and other chip manufacturers.