CVE-2021-3011

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).

• CWE-670

• https://ninjalab.io/a-side-journey-to-titan/Third Party Advisory
• https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdfExploit, Technical Description, Third Party Advisory
• https://ninjalab.io/a-side-journey-to-titan/Third Party Advisory
• https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdfExploit, Technical Description, Third Party Advisory

Published

Jan 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30082An issue was discovered in Gris CMS v0.1. There is a Persist…6.1
• CVE-2021-30083An issue was discovered in Mediat 1.4.1. There is a Reflecte…6.1
• CVE-2021-30086Cross Site Scripting (XSS) vulnerability exists in KindEdito…6.1
• CVE-2021-3010There are multiple persistent cross-site scripting (XSS) vul…5.4
• CVE-2021-30108Feehi CMS 2.1.1 is affected by a Server-side request forgery…9.1
• CVE-2021-30109Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS…6.1
• CVE-2021-30110dttray.exe in Greyware Automation Products Inc Domain Time I…7.5
• CVE-2021-30111A stored XSS vulnerability exists in Web-School ERP V 5.0 vi…5.4
• CVE-2021-30112Web-School ERP V 5.0 contains a cross-site request forgery (…6.5
• CVE-2021-30113A blind XSS vulnerability exists in Web-School ERP V 5.0 via…6.1
• CVE-2021-30114Web-School ERP V 5.0 contains a cross-site request forgery (…6.5
• CVE-2021-30116Kaseya VSA before 9.5.7 allows credential disclosure, as exp…9.8