CVE-2015-5738: The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx...

Security readout for executives and security teams

This flaw can allow remote attackers, under specific conditions, to recover private RSA keys from systems using Cavium SDK 2.x on OCTEON II CN6xxx hardware for TLS PFS. Private key exposure can undermine encrypted sessions and server identity. The source bundle does not show active exploitation. Exposure appears limited to appliances or systems using Cavium SDK 2.x with OCTEON II CN6xxx hardware on Linux for TLS PFS. The bundle does not provide a complete affected-product list, so vendor inventory is required. Treat this as a targeted, hardware-specific key-exposure risk. Prioritize confirming whether affected acceleration exists in externally reachable TLS services, then follow vendor guidance before rotating keys. Mitigation focus: Inventory TLS endpoints using Cavium OCTEON II CN6xxx acceleration or Cavium SDK 2.x.; Check F5, Fortinet, Cavium, and device-vendor guidance for patches or mitigations.; Disable affected RSA-CRT hardware acceleration if vendor guidance recommends it..

Prepared

Jun 13, 2026, 14:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.