VDB
CVE-2020-27208
CVE-2020-27208
PUBLISHED
CVSS 6.800000190734863 MEDIUM
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
EPSS 0.04% · 11.2th percentile
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.04%
11.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| nitrokey | fido2_firmware | |
| solokeys | somu_firmware | |
| solokeys | solo_firmware | 4.0.0 |
| n/a | n/a | n/a |
Exploit Intelligence
- https://www.aisec.fraunhofer.de/en/FirmwareProtection.html (nist-nvd)
- https://twitter.com/SoloKeysSec (circl)
- https://solokeys.com (circl)
- https://eprint.iacr.org/2021/640 (circl)
- https://github.com/solokeys/solo/commit/a9c02cd354f34b48195a342c7f524abdef5cbcec (circl)
- https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html (circl)
Timeline
- May 21, 2021 CVE Published
- May 22, 2021 EPSS Score
- May 29, 2021 EPSS Score
- Jun 8, 2021 EPSS Score
- Sep 24, 2021 EPSS Score
- Nov 24, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 25, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 27, 2022 EPSS Score
- Jul 29, 2022 EPSS Score
References
- https://www.aisec.fraunhofer.de/en/FirmwareProtection.html url
- https://twitter.com/SoloKeysSec url
- https://solokeys.com url
- https://eprint.iacr.org/2021/640 url
- https://github.com/solokeys/solo/commit/a9c02cd354f34b48195a342c7f524abdef5cbcec url
- https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html url
- https://nvd.nist.gov/vuln/detail/CVE-2020-27208 advisory