EUVD-2026-30328
GHSA-j7g5-cj58-4v5f
Severity by source
AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key.
AnalysisAI
Nuvoton NPCT7xx TPM firmware is vulnerable to physical side-channel attacks enabling extraction of Elliptic Curve Diffie-Hellman (ECDH) keys through electromagnetic or timing analysis when an attacker has direct physical access to the TPM device. The vulnerability affects confidentiality of cryptographic material but does not enable code execution or availability attacks. No active exploitation has been publicly reported, and the attack requires specialized knowledge and physical proximity to the target system.
Technical ContextAI
Nuvoton NPCT7xx is a Trusted Platform Module (TPM) 2.0 implementing cryptographic operations including ECDH key agreement per TPM 2.0 specification (RFC 5869). The vulnerability belongs to CWE-1300 (Physical Attacks) and specifically relates to side-channel information disclosure during cryptographic computations. Side-channel attacks exploit physical phenomena such as power consumption variations, electromagnetic emissions, or timing differences during cryptographic operations to infer secret key material. ECDH is commonly used in TPM for secure attestation, key storage sealing, and key derivation. The attack surface is limited to the TPM hardware itself, not higher-level TPM interfaces.
RemediationAI
No vendor-released patch has been independently confirmed at time of analysis. Mitigation strategies focus on environmental and operational controls rather than firmware updates. Organizations should implement physical security measures including: (1) restrict physical access to TPM devices and system internals via tamper-evident seals, locked enclosures, or guarded server rooms-this directly contradicts the AV:P requirement; (2) deploy TPMs in systems with electromagnetic shielding if operating in high-threat environments; (3) monitor for unauthorized physical access attempts via audit logs and motion sensors. For systems unable to implement these controls, consider evaluating alternative TPM vendors or assessing risk acceptance if TPM-sealed secrets do not contain critical material. Consult Nuvoton support (https://www.nuvoton.com) for firmware updates, as public advisories remain limited.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today