Vulnerability · Published Aug 29, 2025 · Assigned by NCSC.ch
CVE-2025-7383Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in Oberon PSA Crypto library
Medium 5.9
In plain English
A medium-severity broken cryptography in Oberon PSA Crypto from Oberon microsystems AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 4.0)5.9Medium
Exploit odds (30 days)<0.1%top 99.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 1.5.1 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oberon microsystems AG | Oberon PSA Crypto | 1.0.0 – through 1.5.0 |
Weakness: CWE-208, CWE-327 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N