CVE-2020-27208

Name of the Vulnerable Software and Affected Versions: SoloKeys Solo versions 4.0.0 Nitrokey FIDO2 token (affected versions not specified)

Description: The issue concerns the flash read-out protection (RDP) level not being enforced during the device initialization phase. This allows an adversary to downgrade the RDP level and access secrets, such as private ECC keys from SRAM, via the debug interface.

Recommendations: For SoloKeys Solo version 4.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Nitrokey FIDO2 token, at the moment, there is no information about a newer version that contains a fix for this vulnerability.