CVE-2022-24584

MEDIUM

Published May 11, 20224y ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published May 11, 2022 4y ago

Last Modified Jun 17, 2026 2w ago

Description

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a secret value, which is imported into the device, should also be stored elsewhere

CVSS Details

Base Score

6.5

Exploitability

2.8

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity High

Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 1

Vendor	Product	Version	Range
yubico	otp	*	any

References 4

demo.yubico.com https://demo.yubico.com/otp/verify

Vendor Advisory
pastebin.com https://pastebin.com/7iLR1EbW

ExploitThird Party Advisory
pastebin.com https://pastebin.com/xAh8uV6J

Third Party Advisory
upload.yubico.com https://upload.yubico.com/

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.