Cyber Resilience

CVE-2024-45678

Medium

Published: 03 September 2024

Published
03 September 2024
Modified
17 March 2025
KEV Added
Patch
CVSS Score v3.1 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0024 48.0th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-45678 is a medium-severity Observable Discrepancy (CWE-203) vulnerability in Yubico Yubikey 5C Nfc Firmware. Its CVSS base score is 4.2 (Medium).

Operationally, ranked at the 48.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of…

more

a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

yubico
yubikey 5c nfc firmware
≤ 5.7
yubico
yubikey 5 nfc firmware
≤ 5.7
yubico
yubikey 5c firmware
≤ 5.7
yubico
yubikey 5 nano firmware
≤ 5.7
yubico
yubikey 5c nano firmware
≤ 5.7
yubico
yubikey 5ci firmware
≤ 5.7
yubico
yubikey 5 nfc fips firmware
≤ 5.7
yubico
yubikey 5c nfc fips firmware
≤ 5.7
yubico
yubikey 5c fips firmware
≤ 5.7
yubico
yubikey 5 nano fips firmware
≤ 5.7
+8 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-203

Misdirection can normalize or falsify responses to eliminate observable discrepancies that aid reconnaissance.

addresses: CWE-203

Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues.

addresses: CWE-203

Prevents attackers from using observable differences in error responses to infer internal system details or state.

References