Vulnerability · Published May 21, 2021 · Assigned by mitre
CVE-2020-12061
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.9%top 20.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the secure element transmits credentials in plain. This allows an adversary to eavesdrop the communication and derive the secrets stored in the microcontroller. As a result, the attacker is able to arbitrarily manipulate the firmware of the microcontroller.
Affected products (as reported)
References
- https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/releases x_refsource_MISC
- https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/commits/master x_refsource_MISC
- https://eprint.iacr.org/2021/640.pdf x_refsource_MISC
- https://cwe.mitre.org/data/definitions/523.html x_refsource_MISC