Executive brief
cue-sdk-node is a Node.js library for interacting with Corsair CUE devices. The package downloads executable files over unencrypted HTTP connections during installation. An attacker with network visibility (such as on public Wi-Fi or a compromised network) can intercept this download and replace the executable with malicious code, gaining code execution on the user's system.
Technical details
The vulnerability is a missing encryption issue (CWE-311) in which cue-sdk-node downloads a required executable over plain HTTP rather than HTTPS. An attacker positioned to perform network interception—such as on a shared network, public Wi-Fi, or with ISP-level access—can perform a man-in-the-middle (MITM) attack to inject malicious code. No user interaction beyond installation is required; exploitation occurs automatically during the package installation phase. No patch has been released as of the advisory date; the recommendation is to avoid the package entirely or install only on trusted private networks.
Affected products
- Corsair cue-sdk-node ≤ 1.2.1
Timeline
- 2019-02-18: disclosed
- other: CVE assigned as CVE-2016-10590