Hmmm. Not excusing Yubico if the report is accurate, but I ordered 4x 5C NFC to replace my old keys, and they shipped with firmware 5.7.1 which does not have th

Hmmm. Not excusing Yubico if the report is accurate, but I ordered 4x 5C NFC to replace my old keys, and they shipped with firmware 5.7.1 which does not have that vulnerability. Perhaps because they got the FIPS version, which is actually less secure because of NSA-borked protocols, but required for government compliance, and probably sells in lower quantities. The 5.7 firmware was released in May and so new-old-stock of the vulnerable firmware should have rotated out a while ago.