On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes a reverse shell.
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| K5_firmware | Keeper | 20.1.0.25 (including) | 20.1.0.25 (including) |
| K5_firmware | Keeper | 20.1.0.63 (including) | 20.1.0.63 (including) |