Microchip Crypto Libraries CVE-2026-89172

Physical proximity to the target hardware is a hard prerequisite - the attacker must be able to instrument the device's power supply or capture its electromagnetic emissions, requiring either direct probe attachment or close EM proximity (typically within centimeters). The vulnerability is specific to firmware derived from Microchip AN1044, AN953, or SW300052; devices using independently implemented or third-party cryptographic libraries are not affected. The CVSS 4.0 AT:P (Attack Target Partial) metric signals that not all devices built on these application notes may be equally vulnerable - device-specific PCB layout, decoupling capacitor placement, or silicon process variation can influence exploitability. Exploitation is further limited to the window during which cryptographic operations are actively executing; powered-off or idle devices cannot be attacked. The attack does not provide integrity or availability impact - only key extraction (confidentiality). Repeated access for trace collection (typically hundreds to thousands of traces) is required, which limits opportunistic or one-shot exploitation.

The CVSS 4.0 base score of 5.6 with AV:P/AC:H/AT:P accurately reflects a genuinely constrained threat model: the attacker must have physical access to the device, specialized laboratory or field measurement equipment (oscilloscope, EM probe, signal acquisition hardware), and advanced expertise in side-channel signal processing - this is not a remotely exploitable or automated attack. Despite VC:H and SC:H indicating full cryptographic key recovery is achievable, the exploitation barrier is realistic only for well-resourced adversaries such as nation-state actors, sophisticated criminal groups, or well-funded hardware security researchers. There is no CISA KEV listing and no EPSS data was provided; the absence of active exploitation signals is consistent with the high physical-access requirement. The highest real-world risk applies to embedded deployments where long-lived devices store high-value keys - secure payment hardware, industrial control nodes, smart meters, or secure element alternatives - rather than general-purpose computing environments. The AT:P condition further limits which specific device variants are exploitable, and defenders should prioritize hardening efforts on devices handling the most sensitive cryptographic material.

An attacker with physical access to a deployed embedded device - such as a smart meter or industrial controller - attaches a current probe to the device's power supply rail and triggers repeated AES encryption operations by replaying valid protocol messages. After collecting thousands of power traces using a digital oscilloscope and applying Differential Power Analysis using publicly available toolkits such as ChipWhisperer, the attacker statistically recovers all 128 or 256 bits of the device's symmetric key. No public POC targeting these specific Microchip implementations is identified, but DPA against unprotected AES is a well-characterized technique with freely available open-source tooling.