What’s Vulnerable › Vulnerabilities

CVE-2024-45678

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-03 · updated 2026-06-17
• Weakness: CWE-203

Description

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.

Affected products

• Yubico Security Key C Nfc By Yubico Firmware: before 5.7 — fixed in 5.7
• Yubico Security Key Nfc By Yubico Firmware: before 5.7 — fixed in 5.7
• Yubico Yubihsm 2 Fips Firmware: before 2.4.0 — fixed in 2.4.0
• Yubico Yubihsm 2 Firmware: before 2.4.0 — fixed in 2.4.0
• Yubico Yubikey 5 Nano Fips Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5 Nano Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5 Nfc Fips Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5 Nfc Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5C Fips Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5C Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5C Nano Fips Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5C Nano Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5C Nfc Fips Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5C Nfc Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5Ci Fips Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey 5Ci Firmware: before 5.7 — fixed in 5.7
• Yubico Yubikey Bio Firmware: before 5.7.2 — fixed in 5.7.2
• Yubico Yubikey C Bio Firmware: before 5.7.2 — fixed in 5.7.2

How to fix

Upgrade to a fixed version: Yubico Security Key C Nfc By Yubico Firmware 5.7; Yubico Security Key Nfc By Yubico Firmware 5.7; Yubico Yubihsm 2 Fips Firmware 2.4.0; Yubico Yubihsm 2 Firmware 2.4.0; Yubico Yubikey 5 Nano Fips Firmware 5.7; Yubico Yubikey 5 Nano Firmware 5.7; Yubico Yubikey 5 Nfc Fips Firmware 5.7; Yubico Yubikey 5 Nfc Firmware 5.7; Yubico Yubikey 5C Fips Firmware 5.7; Yubico Yubikey 5C Firmware 5.7; Yubico Yubikey 5C Nano Fips Firmware 5.7; Yubico Yubikey 5C Nano Firmware 5.7. Check the vendor advisory for mitigations.

References

• https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/
• https://news.ycombinator.com/item?id=41434500
• https://ninjalab.io/eucleak/
• https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf
• https://support.yubico.com/hc/en-us/articles/15705749884444
• https://www.yubico.com/support/security-advisories/ysa-2024-03/

Get alerted when CVE-2024-45678 or the next vulnerability affects your stack