CVEvulnerability
CVE-2020-27208
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-05-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-326
Description
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
Affected configurations
• solokeys solo firmware 4.0.0
• solokeys somu firmware
• nitrokey fido2 firmware
Related
Weakness · CWE (1)
- CWE-326 Inadequate Encryption Strength weakness
References
- https://eprint.iacr.org/2021/640 Third Party Advisory
- https://github.com/solokeys/solo/commit/a9c02cd354f34b48195a342c7f524abdef5cbcec Patch, Third Party Advisory
- https://solokeys.com Product
- https://twitter.com/SoloKeysSec Product
- https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html Third Party Advisory
- https://www.aisec.fraunhofer.de/en/FirmwareProtection.html Exploit, Third Party Advisory
- https://eprint.iacr.org/2021/640 Third Party Advisory
- https://github.com/solokeys/solo/commit/a9c02cd354f34b48195a342c7f524abdef5cbcec Patch, Third Party Advisory
- https://solokeys.com Product
- https://twitter.com/SoloKeysSec Product
- https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html Third Party Advisory
- https://www.aisec.fraunhofer.de/en/FirmwareProtection.html Exploit, Third Party Advisory