Compromised eMudhra intermediate certificates
B Cisco Talos Blog ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The disclosure shows that compromised intermediate CAs affect not only web browsers but also code-signing and VPN trust chains, triggering broader update and trust-store actions.
Description
The eight compromised intermediate certificates from the CA eMudhra used private keys with only single- or double-digit values instead of the required 384 bits of pseudo-random security. As a result, an attacker with the private key of any affected intermediate CA can impersonate arbitrary websites or services. Six TLS certificates were blocked by Chrome, Mozilla and Apple, and two certificates used by Microsoft for code signing were also blocked. eMudhra has revoked the certificates; because non-browser applications such as VPNs do not always check revocation lists, further software updates may be required.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 15.00
- industry weight
- 1.10
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 20.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -3.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
TTP_SKIPPEDTTP mapping skipped (placeholder or aggregation article) −3
- Consensus penalty:
- −3.0
- Total penalty:
- −3.0