CVE-2025-3301CWE-1255

DPA Countermeasures Unavailable for Certain Cryptographic Operations on Series 2 Devices

Low · published April 29, 2025

CVSS v4.0
1.0
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to use the impacted crypto curves and operations with ephemeral keys to reduce the number of DPA traces that can be collected.

The record
Technical detail
CVSS v4.0
1.0 · LOW
Vector
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00216 · 11.9th percentile
Weakness
CWE-1255 · Comparison Logic is Vulnerable to Power Side-Channel Attacks
Published
2025-04-29T13:47Z
EPSS history
Timeline
  • 29 APR 13:47Z
    DPA Countermeasures Unavailable for Certain Cryptographic Operations on Series 2 Devices
    cvelistv5