{"id":"CVE-2024-45678","aliases":["EUVD-2024-41550","GHSA-cf4q-v7mm-g53q"],"status":"published","title":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware...","description":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00327,"percentile":0.26011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-203"],"published":"2024-09-03T00:00:00Z","modified":"2026-06-17T07:54:39Z","products":[{"vendor":"yubico","product":"security_key_c_nfc_by_yubico_firmware"},{"vendor":"yubico","product":"security_key_nfc_by_yubico_firmware"},{"vendor":"yubico","product":"yubihsm_2_fips_firmware"},{"vendor":"yubico","product":"yubihsm_2_firmware"},{"vendor":"yubico","product":"yubikey_5_nano_fips_firmware"},{"vendor":"yubico","product":"yubikey_5_nano_firmware"},{"vendor":"yubico","product":"yubikey_5_nfc_fips_firmware"},{"vendor":"yubico","product":"yubikey_5_nfc_firmware"},{"vendor":"yubico","product":"yubikey_5c_fips_firmware"},{"vendor":"yubico","product":"yubikey_5c_firmware"},{"vendor":"yubico","product":"yubikey_5c_nano_fips_firmware"},{"vendor":"yubico","product":"yubikey_5c_nano_firmware"},{"vendor":"yubico","product":"yubikey_5c_nfc_fips_firmware"},{"vendor":"yubico","product":"yubikey_5c_nfc_firmware"},{"vendor":"yubico","product":"yubikey_5ci_fips_firmware"},{"vendor":"yubico","product":"yubikey_5ci_firmware"},{"vendor":"yubico","product":"yubikey_bio_firmware"},{"vendor":"yubico","product":"yubikey_c_bio_firmware"}],"references":[{"url":"https://www.yubico.com/support/security-advisories/ysa-2024-03/","tags":["Vendor Advisory"]},{"url":"https://support.yubico.com/hc/en-us/articles/15705749884444","tags":["Mitigation","Third Party Advisory"]},{"url":"https://ninjalab.io/eucleak/","tags":["Third Party Advisory"]},{"url":"https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf","tags":["Technical Description"]},{"url":"https://news.ycombinator.com/item?id=41434500","tags":["Issue Tracking"]},{"url":"https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/","tags":["Press/Media Coverage"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45678"},{"url":"https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel"},{"url":"https://ninjalab.io/eucleak"},{"url":"https://www.yubico.com/support/security-advisories/ysa-2024-03"},{"url":"https://github.com/advisories/GHSA-cf4q-v7mm-g53q"}],"sources":{"cve":[{"id":"CVE-2024-45678","description":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.","status":"published","published":"2024-09-03T00:00:00Z","modified":"2025-03-17T17:51:54.621Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-41550","description":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.","status":"published","published":"2024-09-03T00:00:00Z","modified":"2025-03-17T17:51:54Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:01.76583Z"}],"ghsa":[{"id":"GHSA-cf4q-v7mm-g53q","title":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware...","description":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.","status":"published","published":"2024-09-03T21:31:12Z","modified":"2024-09-12T21:33:04Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:58:15.26738Z"}],"nvd":[{"id":"CVE-2024-45678","description":"Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.","status":"published","published":"2024-09-03T20:15:08.86Z","modified":"2026-06-17T07:54:39.063Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:10:24.514378Z"}]}}