CVE-2025-69893

Katalog CVE

CVSS 4.6 · Medium EPSS 0,24%

Kerentanan Covert Timing Channel. Skor CVSS 3.1 4.6 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard guidelines, which induce non-constant time execution and specific branch patterns for word searching. An attacker with physical access during the initial setup phase can collect a single side-channel trace. By utilizing profiling-based Deep Learning Side-Channel Analysis (DL-SCA), the attacker can recover the mnemonic code and subsequently steal the assets. The issue was patched.

Rincian

Terbit di NVD

14 April 2026

Terakhir diubah

5 Juli 2026

Status NVD

Deferred

CVSS 3.1

4.6 (Medium), sumber CISA ADP
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-385: Covert Timing Channel

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked