Nitrokey nitrokey-3-firmware 1.8.0 improper authentication

Summaryinfo

A vulnerability was found in Nitrokey nitrokey-3-firmware 1.8.0. It has been rated as critical. This affects an unknown part. This manipulation causes improper authentication. This vulnerability is handled as CVE-2025-25201. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Nitrokey nitrokey-3-firmware 1.8.0. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect integrity. The summary by CVE is:

Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the application. An attacker without access to the proper administration key would be able to generate new keys and overwrite certificates. Such an attacker would not be able to read-out or extract existing private data, nor would they be able to gain access to cryptographic operations that would normally require PIN-based authentication. The issue is fixed in piv-authenticator 0.3.9, and in Nitrokey's firmware 1.8.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-25201 since 02/03/2025. The exploitation appears to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.8.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• Nitrokey

Name

• nitrokey-3-firmware

Version

• 1.8.0

Website

• Product: https://github.com/Nitrokey/nitrokey-3-firmware/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion