New Eucleak attack lets threat actors clone YubiKey FIDO keys
A new "EUCLEAK" flaw found in FIDO devices using the Infineon SLE78 security microcontroller, like Yubico's YubiKey 5 Series, allows attackers to extract Elliptic Curve Digital Signature Algorithm (ECDSA) secret keys and clone the FIDO device.
NinjaLab's Thomas Roche, who discovered the flaw and devised the EUCLEAK side-channel attack, notes that the side channel can retrieve an ECDSA secret key using EM acquisitions.
However, the attack requires extended physical access, specialized equipment, and a high level of understanding of electronics and cryptography.
These prerequisites significantly mitigate the risk, limiting it mostly to attacks from highly sophisticated, state-sponsored threat actors against high-value targets. With that said, EUCLEAK is not considered a threat to general users, even to those who use theoretically vulnerable devices.
In 2021, Roche found a side-channel attack that targeted Google Titan security keys, allowing him to extract the ECDSA private key and clone the device.

Yubico responds to EUCLEAK
The flaw impacts YubiKey 5 Series devices running firmware versions older than 5.7.0, which uses Infineon's flawed cryptographic library.
The models impacted by EUCLEAK are:
- YubiKey 5 Series versions prior to 5.7
- YubiKey 5 FIPS Series prior to 5.7
- YubiKey 5 CSPN Series prior to 5.7
- YubiKey Bio Series versions prior to 5.7.2
- Security Key Series all versions prior to 5.7
- YubiHSM 2 versions prior to 2.4.0
- YubiHSM 2 FIPS versions prior to 2.4.0
The vendor rated the issue as moderate, assigning a CVSS score of only 4.9, which reflects its low risk.
Also, Yubico notes in its advisory that attackers attempting to recover credentials from impacted keys would require the user PIN or biometric verification for full exploitation, making successful attacks even harder.
YubiKey owners can check the firmware version of the security keys using YubiKey Manager or YubiKey Authenticator.

Unfortunately, if you are using a vulnerable version, there is no way to upgrade the firmware to the latest 5.7.0 (YubiKey) or 2.4.0 (YubiHSM) versions to mitigate this flaw.
The vendor recommends using RSA signing keys instead of elliptic curve (ECC) signing keys and limiting the maximum session duration from the identity provider settings to require more frequent FIDO authentications.
Other impacted products
NinjaLab confirmed that EUCLEAK also impacts Infineon TPMs (SLB96xx), used for secure boot, authentication, and cryptographic operations, and Infineon's Optiga Trust M security microcontroller, used in IoT devices.
Infineon TPMs are used in the smart enclaves of old (between 2013 and 2018) smartphones and tablets from Samsung and OnePlus, and also some dated (from mid-2010s) laptop models from Lenovo, Acer, Dell, HP, and LG.
The Feitian A22 JavaCard, used in smart cards and authentication systems, is also impacted by using the Infineon SLE78 microcontroller.
Other potentially impacted devices include e-passports, cryptocurrency hardware wallets (cold wallets), IoT devices, and any FIDO device that uses Infineon's SLE78.
Android Users Urged to Install Latest Security Updates to Fix Actively Exploited Flaw
Cisco fixes root escalation vulnerability with public exploit code
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability
CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability
CVE-2024-49035 Microsoft Partner Center Improper Access Control Vulnerability
CVE-2024-50302 Linux Kernel Use of Uninitialized Resource Vulnerability
CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability
Free online web security scanner