EUVD-2026-76846
GHSA-pxq3-m9x7-5w4m
Severity by source
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access and specialized measurement equipment required; scope changed because extracted keys compromise downstream protected systems, not just the vulnerable device itself.
Primary rating from Vendor (Microchip).
CVSS VectorVendor: Microchip
Lifecycle Timeline
1DescriptionCVE.org
Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052.
This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.
AnalysisAI
Side-channel leakage in Microchip's AN1044, AN953, and SW300052 cryptographic reference implementations allows a physically proximate attacker with specialized measurement equipment to extract secret cryptographic keys through power, electromagnetic, or timing analysis. Affected through revision A (AN1044, AN953) and version 2.6 (SW300052), these application notes and associated library are commonly used by embedded developers implementing cryptography on Microchip microcontrollers, meaning extracted keys could compromise the security of devices and downstream systems they protect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical proximity to the target hardware is a hard prerequisite - the attacker must be able to instrument the device's power supply or capture its electromagnetic emissions, requiring either direct probe attachment or close EM proximity (typically within centimeters). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.6 with AV:P/AC:H/AT:P accurately reflects a genuinely constrained threat model: the attacker must have physical access to the device, specialized laboratory or field measurement equipment (oscilloscope, EM probe, signal acquisition hardware), and advanced expertise in side-channel signal processing - this is not a remotely exploitable or automated attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Microchip's advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/side-channel-attack-an1044-an953-sw300052-cryptographic-algorithms for current guidance on updated revisions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today