35
CVE-2024-45678
—CVSS 3.1
4.2 medium
EPSS
<1%p26
Published
()
Modified
Description
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
- Vendors
- yubico
- Products
- yubikey 5c nfc firmware, yubikey 5 nfc firmware, yubikey 5c firmware, yubikey 5 nano firmware, yubikey 5c nano firmware, yubikey 5ci firmware, yubikey 5 nfc fips firmware, yubikey 5c nfc fips firmware, yubikey 5c fips firmware, yubikey 5 nano fips firmware, yubikey 5c nano fips firmware, yubikey 5ci fips firmware
- Weakness
- CWE-203
- Vector
- CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N