Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Datakey iKey2032 USB token may expose user PINs

CVE-2004-1709 · published 22 years ago
Summary

The Datakey Rainbow iKey2032 USB token’s communication with its driver is not encrypted when used with the CIP client package. This allows anyone with local access to the computer to capture the PINs entered for other users. Apply the vendor’s security update or switch to a client package that encrypts the data to protect the PINs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
datakey rainbow_ikey2032_usb_token All versions
cpe:2.3:h:datakey:rainbow_ikey2032_usb_token:*:*:*:*:*:*:*:*
Original advisory text
Datakey Rainbow iKey2032 USB token, when using the CIP client package, does not encrypt communications between the token and the driver, which could allow local users to obtain the PINs of other us...
Datakey Rainbow iKey2032 USB token, when using the CIP client package, does not encrypt communications between the token and the driver, which could allow local users to obtain the PINs of other users.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Timeline
Published4 Aug 2004
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2004-1709 · NVD
Track software like this
Free during beta