Response to the disputing comments from the Vendor:

Nowhere is claimed that the secrets can be extracted from the device. The vulnerability lies in the fact that the Yubico OTP Validation Server (Yubico Validation Service, YubiCloud) ASKS for the SERIAL NUMBER of the device when uploading a new configuration, but does not, in fact, check that a particular generated OTP was actually generated by the device with that serial number. Basically, the "Serial Number" field during the upload of a new configuration is not validated in any way and does not take part in any verification. The server does not differentiate between same secrets stored on different devices, or same device Serial Number having many configurations (even if those configurations were uploaded by someone using a random made-up serial number).