PT-2023-20281 · Onekey · Onekey Mini+1

Publicado 2023-02-14 · Atualizado 2025-03-20 · CVE-2023-25758

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Média

Vetor base

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Onekey Touch devices through 4.0.0 Onekey Mini devices through 2.10.0

Description The issue allows man-in-the-middle attackers to obtain the seed phase. This can be achieved after disassembling a device, with the term "man-in-the-middle" referring to physical access rather than network positioning. The vendor has stated that a security patch has been updated by their hardware team, indicating that no users were affected.

Recommendations For Onekey Touch devices through 4.0.0, update the device to a version later than 4.0.0. For Onekey Mini devices through 2.10.0, update the device to a version later than 2.10.0.

Correção

Identificadores relacionados

CVE-2023-25758

Produtos afetados

Onekey Mini

Onekey Touch

Referências · 6

• https://github.com/OneKeyHQ/firmware · Nota
• https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardware-security/amp · Nota
• https://blog.onekey.so/our-response-to-recent-security-fix-reports-13914fea8afd · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25758 · Nota de Segurança
• https://t.me/cvenotify/115553 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25758 · Aviso do Fabricante