CVE-2020-27208

Katalog CVE

CVSS 6.8 · Medium EPSS 0,33%

Kerentanan Inadequate Encryption Strength pada solokeys solo firmware, solokeys somu firmware +1 lainnya. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.

Rincian

Terbit di NVD

21 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-326: Inadequate Encryption Strength

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/solokeys/solo/commit/a9c02cd354f34b48195a342c7f524abdef5cbcec patch · advisory pihak ketiga
• https://eprint.iacr.org/2021/640 advisory pihak ketiga
• https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-... advisory pihak ketiga
• https://www.aisec.fraunhofer.de/en/FirmwareProtection.html exploit · advisory pihak ketiga
• https://solokeys.com product
• https://twitter.com/SoloKeysSec product