CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks
Filter
A device's real time power consumption may be monitored during security token evaluation and the information gleaned may be used to determine the value of the reference token.
What the weakness is: CWE-1255 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-189 Black Box Reverse Engineering Severity: Low
The attack patterns MITRE's CAPEC relates to CWE-1255, as MITRE names them. Credits.
Ask an AI about CWE-1255
Show the prompt
Explain CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1255.html and https://cve.bz/cve/cwe/1255?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.9CVE-2026-63410EPSS 0.3%
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when comp…
- 1.0CVE-2025-3301EPSS 0.2%
DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in expos…
- 4.3CVE-2024-39920EPSS 0.6%
The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at…
- 9.8CVE-2024-25714EPSS 0.8%
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_mem…