CVE-2020-12061

9.8 criticalEPSS 1.9%

Critical (9.8) in nitrokey fido u2f firmware. EPSS 1.9% chance of exploitation in the next 30 days.

An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the secure element transmits credentials in plain. This allows an adversary to eavesdrop the communication and derive the secrets stored in the microcontroller. As a result, the attacker is able to arbitrarily manipulate the firmware of the microcontroller.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2021-05-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nitrokey:fido_u2f_firmware

References

https://cwe.mitre.org/data/definitions/523.html
https://eprint.iacr.org/2021/640.pdf
https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/commits/master
https://github.com/Nitrokey/nitrokey-fido-u2f-firmware/releases
https://cwe.mitre.org/data/definitions/523.html

Check your stack JSON