CVE-2020-15001: yubico yubikey 5 nfc firmware

csirt@kutim:~/threat-intel/cve/CVE-2020-15001

CVSS 5.3 · Medium EPSS 0,55%

Kerentanan Missing Authorization pada yubico yubikey 5 nfc firmware. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when updating NFC specific components of the OTP configurations. This may allow an attacker to access configured OTPs and passwords stored in slots that were not configured by the user to be read over NFC, despite a user having set an access code. (Users who have not set an access code, or who have not configured the OTP slots, are not impacted by this issue.)

Rincian

Terbit di NVD: 9 Juli 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,55% peluang dieksploitasi; lebih tinggi dari 44,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
yubico	yubikey 5 nfc firmware	Versi 5.0.0 hingga 5.2.6
yubico	yubikey 5 nfc firmware	Versi 5.3.0 hingga 5.3.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.yubico.com/support/security-advisories/ysa-2020-04/ exploit · mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.