PT-2025-7057 · Nitrokey · Nitrokey 3 Firmware

Published 2025-02-12 · Updated 2025-02-12 · CVE-2025-25201

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Nitrokey 3 Firmware versions 1.8.0 and prior test releases with PIV enabled

Description: The PIV application in the Nitrokey 3 Firmware could accept invalid keys for authentication of the admin key, potentially compromising the integrity of the data stored in the application. An attacker without access to the proper administration key could generate new keys and overwrite certificates, but would not be able to read or extract existing private data, nor gain access to cryptographic operations that require PIN-based authentication.

Recommendations: For Nitrokey 3 Firmware version 1.8.0 and prior test releases with PIV enabled, update to firmware version 1.8.1 to resolve the issue. As a temporary workaround, consider restricting access to the PIV application until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-25201

GHSA-JFHM-PPQ8-7HGX

Affected Products

Nitrokey 3 Firmware

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25201.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25201 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25201 · Vendor Advisory
• https://github.com/Nitrokey/nitrokey-3-firmware/releases/tag/v1.8.1 · Note
• https://github.com/Nitrokey/nitrokey-3-firmware/security/advisories/GHSA-jfhm-ppq8-7hgx · Note
• https://t.me/cvedetector/17926 · Telegram Post
• https://nitrokey.com/blog/2025/nitrokey-3-firmware-v181-security-update · Note
• https://twitter.com/CVEnew/status/1889761635109314927 · Twitter Post