CVE-2025-54764
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-31
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arm | mbed_tls | to 3.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-208 | Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mbed TLS versions before 3.6.5 allows a local attacker to perform a timing attack on certain RSA operations and on direct calls to specific mathematical functions (mbedtls_mpi_mod_inv or mbedtls_mpi_gcd). This means an attacker could potentially gain sensitive information by measuring the time taken to perform these cryptographic operations.
How can this vulnerability impact me? :
The vulnerability could allow a local attacker to extract sensitive cryptographic information by analyzing timing differences during RSA operations, potentially compromising the security of encrypted data or cryptographic keys.