CVE-2025-25201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-25201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-25201
Aliases
  • GHSA-jfhm-ppq8-7hgx
Published
2025-02-12T18:07:13.686Z
Modified
2026-07-15T01:49:20.197559338Z
Severity
  • 4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Improper Validation of Admin Key in PIV Smartcard
Details

Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the application. An attacker without access to the proper administration key would be able to generate new keys and overwrite certificates. Such an attacker would not be able to read-out or extract existing private data, nor would they be able to gain access to cryptographic operations that would normally require PIN-based authentication. The issue is fixed in piv-authenticator 0.3.9, and in Nitrokey's firmware 1.8.1.

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25201.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nitrokey/nitrokey-3-firmware

Affected ranges

Type
GIT
Repo
https://github.com/nitrokey/nitrokey-3-firmware
Events
Introduced
8bfc4fb63d8f2004368a089bdb9900bb03902ce2
Fixed
8e81fd421efbfdf3b0df76e586897dc1140aed71
Database specific 
{
    "extracted_events": [
        {
            "introduced": "= 1.8.0"
        },
        {
            "last_affected": "= 1.8.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

= 1.*
= 1.8.0
v1.*
v1.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25201.json"