High
Security advisory
Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-41096
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:53 UTC · Revision 1
Source evidence
Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required.
osv:CVE-2021-41096
Complete source record
{
"id": "2e1b36832577388b37caf9adb4df12934068d66fc147d08fe5344c4578b75803",
"url": "https://osv.dev/vulnerability/CVE-2021-41096",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-41096",
"summary": "Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required.",
"evidence": "osv:CVE-2021-41096",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-41096",
"aliases": [
"CVE-2021-41096",
"GHSA-32m7-456v-wgfw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mayankmetha/rucky",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "48fe028f3ea4b3e7544f03bce21ed6c93320abd4"
},
{
"fixed": "5e3a477365009f488a73efd26a91168502de1b93"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rucky_project:rucky:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "5e3a477365009f488a73efd26a91168502de1b93"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.2",
"2.1",
"2.0",
"1.9",
"1.8",
"1.7",
"1.6",
"1.5",
"1.4",
"1.3",
"1.2",
"1.1",
"1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41096.json",
"vanir_signatures": [
{
"id": "CVE-2021-41096-4d784908",
"digest": {
"threshold": 0.9,
"line_hashes": [
"36139303741177313712045485323918694941",
"330896420744429202929028829877052246207",
"303351355776508932431768391220078207731",
"246641387394025854117350498103808224585",
"104573523005990588202974897827605002984"
]
},
"source": "https://github.com/mayankmetha/rucky/commit/5e3a477365009f488a73efd26a91168502de1b93",
"target": {
"file": "app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41096-6f36a9cd",
"digest": {
"length": 1106,
"function_hash": "197244104767391408009134254427680386101"
},
"source": "https://github.com/mayankmetha/rucky/commit/5e3a477365009f488a73efd26a91168502de1b93",
"target": {
"file": "app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java",
"function": "updateStatus"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41096-91d5df12",
"digest": {
"threshold": 0.9,
"line_hashes": [
"336401844564868207412137317502660699653",
"244681312511404319471135565964128796452",
"172958805059072648498455729820626846900",
"232294838118719937317370879063460203103",
"19127615541084363029077055259622291019",
"62779345299265859850019787110583385787",
"210539749145132758329303634167652734366"
]
},
"source": "https://github.com/mayankmetha/rucky/commit/5e3a477365009f488a73efd26a91168502de1b93",
"target": {
"file": "app/src/main/java/com/mayank/rucky/utils/Randoms.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41096-b1cb665b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30850179477233262800974720103266693413",
"298133565078009718254250703856915508661",
"74181897181156011816469431023642884277",
"336487501109454052064246782028766785150",
"301742228892140317140296651444043136282",
"146113648087197939516077373026751690805",
"260044984883403456929619744457038640292"
]
},
"source": "https://github.com/mayankmetha/rucky/commit/5e3a477365009f488a73efd26a91168502de1b93",
"target": {
"file": "app/src/main/java/com/mayank/rucky/utils/Constants.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:29:26Z"
}
}
],
"modified": "2026-10-20T14:29:26.413174605Z",
"provider": "osv",
"references": [
"https://github.com/mayankmetha/Rucky/security/advisories/GHSA-32m7-456v-wgfw",
"https://github.com/mayankmetha/Rucky/commit/5e3a477365009f488a73efd26a91168502de1b93"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-41096",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 389073,
"published_at": "2021-09-27T20:15:07.337+00:00"
}