Is CVE-2020-15001 actively exploited?

No active exploitation of CVE-2020-15001 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-15001 be exploited remotely?

Partially. CVE-2020-15001 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2020-15001?

CVE-2020-15001 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2020-15001

MEDIUM

CVE-2020-15001

CWE-862Published: July 9, 2020· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when updating NFC specific components of the OTP configurations. This may allow an attacker to access configured OTPs and passwords stored in slots that were not configured by the user to be read over NFC, despite a user having set an access code. (Users who have not set an access code, or who have not configured the OTP slots, are not impacted by this issue.)

NVD Source

Technical Analysis

CVE-2020-15001 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.3.