CVE-2020-27208
The flash read-out protection (RDP) level is not enforced during the device initialization phase...
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
- Record
CVE-2020-27208- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-326
- Updated
- 2026-11-02
CVE List No score
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
- Record
CVE-2020-27208- Updated
- 2026-11-02
EUVDEUVD-2020-19727 No score
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
- Record
EUVD-2020-19727- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m4fc-4f5m-5hhw No score
The flash read-out protection (RDP) level is not enforced during the device initialization phase...
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
- Record
GHSA-m4fc-4f5m-5hhw- Weakness
- CWE-326
- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1019-1 No score
Security update for solo
This update for solo fixes the following issues:
Update to Solo 4.1.2
- Fix boo#1186848 CVE-202-27208, security issue in firmware source that is part of the source package.
- Record
openSUSE-SU-2021:1019-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
soloSUSE:Package Hub 15 SP2 |
before 4.1.2-bp153.2.3.1 | 4.1.2-bp153.2.3.1 |
soloSUSE:Package Hub 15 SP3 |
before 4.1.2-bp153.2.3.1 | 4.1.2-bp153.2.3.1 |
soloopenSUSE:Leap 15.2 |
before 4.1.2-bp153.2.3.1 | 4.1.2-bp153.2.3.1 |
soloopenSUSE:Leap 15.3 |
before 4.1.2-bp153.2.3.1 | 4.1.2-bp153.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27208 is a medium vulnerability (CVSS 6.8) in Nitrokey Fido2 Firmware, published May 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in solo 4.1.2-bp153.2.3.1.