Is CVE-2019-15809 being actively exploited?

CVE-2019-15809 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2019-15809?

CVE-2019-15809 has a CVSS 3.1 base score of 4.7 (MEDIUM).

CVE-2019-15809

MEDIUM · CVSS 4.7EPSS 0.5%EU EUVD

Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because the Atmel Toolbox 00.03.11.05 contains two versions of ECDSA signature functions, described as fast and secure, but the affected cards chose to use the fast version, which leaks the bit length of the random nonce via timing. This affects Athena IDProtect 010b.0352.0005, Athena IDProtect 010e.1245.0002, Athena IDProtect 0106.0130.0401, Athena IDProtect 010e.1245.0002, Valid S/A IDflex V 010b.0352.0005, SafeNet eToken 4300 010e.1245.0002, TecSec Armored Card 010e.0264.0001, and TecSec Armored Card 108.0264.0001.

Key facts

CVSS score: 4.7 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-203
EPSS score: 0.5% (39th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2019-6727)
Published: October 3, 2019
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2019-6727 in the EU Vulnerability Database. Last updated in EUVD on August 5, 2024.

View on the EU Vulnerability Database

Affected products

athena-scs / idprotect
athena-scs / idprotect
athena-scs / idprotect
cryptsoft / s/a idflex v
microchip / atmel toolbox
tecsec / armored card
tecsec / armored card
thalesgroup / etoken 4300

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

IDProtect Key with LASER PKI - Athena Smartcard Inc. - FIPS 140 1750 - historical

References

http://www.openwall.com/lists/oss-security/2019/10/02/2(Mailing List, Third Party Advisory)
https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/details?source=ECDSA&number=214(Third Party Advisory, US Government Resource)
https://eprint.iacr.org/2011/232.pdf(Technical Description, Third Party Advisory)
https://minerva.crocs.fi.muni.cz/(Exploit, Third Party Advisory)
https://tches.iacr.org/index.php/TCHES/article/view/7337(Technical Description, Third Party Advisory)
https://www.ssi.gouv.fr/certification_cc/bibliotheque-cryptographique-atmel-toolbox-00-03-11-05/(Product)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain