CVE-2023-25758

Katalog CVE

CVSS 4.2 · Medium EPSS 0,27%

Kerentanan pada onekey touch firmware, onekey mini firmware. Skor CVSS 3.1 4.2 (Medium) menurut NVD.

Deskripsi (NVD)

Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device (i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP network). NOTE: the vendor states that "our hardware team has updated the security patch without anyone being affected."

Rincian

Terbit di NVD

14 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.2 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.onekey.so/our-response-to-recent-security-fix-reports-13914fea8afd advisory vendor
• https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardwa... advisory pihak ketiga
• https://github.com/OneKeyHQ/firmware product