PT-2023-20281 · Onekey · Onekey Mini+1

Published 2023-02-14 · Updated 2025-03-20 · CVE-2023-25758

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Onekey Touch devices through 4.0.0 Onekey Mini devices through 2.10.0

Description The issue allows man-in-the-middle attackers to obtain the seed phase. This can be achieved after disassembling a device, with the term "man-in-the-middle" referring to physical access rather than network positioning. The vendor has stated that a security patch has been updated by their hardware team, indicating that no users were affected.

Recommendations For Onekey Touch devices through 4.0.0, update the device to a version later than 4.0.0. For Onekey Mini devices through 2.10.0, update the device to a version later than 2.10.0.

Fix

Related Identifiers

CVE-2023-25758

Affected Products

Onekey Mini

Onekey Touch

References · 6

• https://blog.onekey.so/our-response-to-recent-security-fix-reports-13914fea8afd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25758 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25758 · Vendor Advisory
• https://github.com/OneKeyHQ/firmware · Note
• https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardware-security/amp · Note
• https://t.me/cvenotify/115553 · Telegram Post