CVE-2021-3011: Ftsafe k13

Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days.

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).

Affected products

  • Ftsafe k13: affected versions not specified
  • Ftsafe k21: affected versions not specified
  • Ftsafe k40: affected versions not specified
  • Ftsafe k9: affected versions not specified
  • Google Titan Security Key: affected versions not specified
  • Nxp 3a081: affected versions not specified
  • Nxp a7005a: affected versions not specified
  • Nxp j2a081: affected versions not specified
  • Nxp j2d081 m59: affected versions not specified
  • Nxp j2d081 m61: affected versions not specified
  • Nxp j2d082 m60: affected versions not specified
  • Nxp j2d120 m60: affected versions not specified
  • Nxp j2d145 m59: affected versions not specified
  • Nxp j2e081 m64: affected versions not specified
  • Nxp j2e082 m65: affected versions not specified
  • Nxp j2e120 m65: affected versions not specified
  • Nxp j2e145 m64: affected versions not specified
  • Nxp j3a041: affected versions not specified
  • Nxp j3d081 m59: affected versions not specified
  • Nxp j3d081 m59 Df: affected versions not specified
  • Nxp j3d081 m61: affected versions not specified
  • Nxp j3d081 m61 Df: affected versions not specified
  • Nxp j3d082 m60: affected versions not specified
  • Nxp j3d120 m60: affected versions not specified
  • Nxp j3d145 m59: affected versions not specified
  • and 20 more

Published 2021-01-07. Last modified 2026-06-17.