PT-2026-32627 · Undefined · Undefined

Published 2026-04-14 · Updated 2026-04-19 · CVE-2025-69893

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trezor One versions 1.13.0 through 1.14.0 Trezor T versions 1.13.0 through 1.14.0 Trezor Safe versions 1.13.0 through 1.14.0

Description A side-channel issue exists in the implementation of BIP-39 mnemonic processing. This is caused by BIP-39 standard guidelines that lead to non-constant time execution and specific branch patterns during word searching. An attacker with physical access during the initial setup phase can collect a side-channel trace and use profiling-based Deep Learning Side-Channel Analysis (DL-SCA)—a method of using neural networks to identify patterns in power consumption or electromagnetic emissions—to recover the mnemonic code and steal assets.

Recommendations Update Trezor One to a version later than 1.14.0. Update Trezor T to a version later than 1.14.0. Update Trezor Safe to a version later than 1.14.0.

Fix

Weakness Enumeration

CWE-385

Related Identifiers

CVE-2025-69893

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-69893 · Security Note
• https://trezor.io/vulnerability/fix-side-channel-in-bip-39-mnemonic-processing-when-unlocked · Note
• https://twitter.com/CVEnew/status/2045972396654645725 · Twitter Post
• http://trezor.com · Note