PT-2020-14110 · Yubico · Yubikey 5 Nfc

Published 2020-07-09 · Updated 2021-07-21 · CVE-2020-15001

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yubico YubiKey 5 NFC devices versions 5.0.0 through 5.2.6 Yubico YubiKey 5 NFC devices versions 5.3.0 through 5.3.1

Description An information leak was discovered in the OTP application, which allows users to set optional access codes on OTP slots. However, the access code is not checked when updating NFC specific components of the OTP configurations. This may allow an attacker to access configured OTPs and passwords stored in slots that were not configured by the user to be read over NFC, despite a user having set an access code. Users who have not set an access code or who have not configured the OTP slots are not impacted by this issue.

Recommendations For versions 5.0.0 through 5.2.6, consider disabling the NFC functionality for OTP slots until a patch is available. For versions 5.3.0 through 5.3.1, consider disabling the NFC functionality for OTP slots until a patch is available. As a temporary workaround, consider restricting access to the OTP application to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-15001

Affected Products

Yubikey 5 Nfc

References · 4

• 🔥 https://yubico.com/support/security-advisories/ysa-2020-04 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15001 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15001 · Vendor Advisory
• https://t.me/cvenotify/4958 · Telegram Post