CVE-2022-30330

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-07 · updated 2026-06-17
Weakness: CWE-20

Description

In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes.

Affected products

Keepkey Firmware: before 7.3.2 — fixed in 7.3.2

How to fix

Upgrade to a fixed version: Keepkey Firmware 7.3.2. Check the vendor advisory for mitigations.

References

https://blog.inhq.net/posts/keepkey-CVE-2022-30330/
https://github.com/keepkey/keepkey-firmware/commit/447c1f038a31378ab9589965c098467d9ea6cccc
https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2
https://blog.inhq.net/posts/keepkey-CVE-2022-30330/
https://github.com/keepkey/keepkey-firmware/commit/447c1f038a31378ab9589965c098467d9ea6cccc
https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2

Get alerted when CVE-2022-30330 or the next vulnerability affects your stack