CVE-2024-45678

MEDIUM

4.2

CVSS Score

Published: September 3, 2024 at 12:00 AM UTC

Updated: June 17, 2026 at 07:54 AM UTC

36 products affected across 1 vendorYubikey 5 Nfc FirmwareYubikey Bio FirmwareYubikey 5C Fips Firmware

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.2

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Security Key C Nfc by Yubico Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-security-key-c-nfc-by-yubico (same device)

Security Key Nfc by Yubico Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-security-key-nfc-by-yubico (same device)

Yubihsm 2 Fips Firmware · Yubico

95%

v < 2.4.0

Affected range stops below 2.4.0, so it looks safe — our inference, not a vendor statement

yubico-yubihsm-2-fips (same device)

Yubihsm 2 Firmware · Yubico

95%

v < 2.4.0

Affected range stops below 2.4.0, so it looks safe — our inference, not a vendor statement

yubico-yubihsm-2 (same device)

Yubikey 5 Nano Fips Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-yubikey-5-nano-fips (same device)

Yubikey 5 Nano Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-yubikey-5-nano (same device)

Yubikey 5 Nfc Fips Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-yubikey-5-nfc-fips (same device)

Yubikey 5 Nfc Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-yubikey-5-nfc (same device)

Yubikey 5C Fips Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-yubikey-5c-fips (same device)

Yubikey 5C Firmware · Yubico

95%

v < 5.7

Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement

yubico-yubikey-5c (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (6)

Press/Media Coverage

Source: [email protected]

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

Issue Tracking

Source: [email protected]

https://news.ycombinator.com/item?id=41434500

Third Party Advisory

Source: [email protected]

https://ninjalab.io/eucleak/

Technical Description

Source: [email protected]

https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf

MitigationThird Party Advisory

Source: [email protected]

https://support.yubico.com/hc/en-us/articles/15705749884444

Vendor Advisory

Source: [email protected]

https://www.yubico.com/support/security-advisories/ysa-2024-03/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.2MEDIUMCISA-ADP

Attack Vector: PHYSICAL
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-203

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card