Vulnerability · Published Aug 29, 2025 · Assigned by NCSC.ch
CVE-2025-7071Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto library
Medium 5.9
In plain English
A medium-severity broken cryptography in ocrypto from Oberon microsystems AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 4.0)5.9Medium
Exploit odds (30 days)<0.1%top 99.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oberon microsystems AG | ocrypto | 3.1.0 – through 3.9.1 |
Weakness: CWE-208, CWE-327 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N