CVE-2025-69893

CVE-2025-69893 is a side-channel vulnerability affecting multiple Trezor hardware wallet models (One, T, and Safe) across firmware versions 1.13.0 to 1.14.0. The flaw stems from non-constant time execution patterns in BIP-39 mnemonic word processing, which leaks timing information during the wallet initialization phase. The vulnerability requires physical access to the device during initial setup and allows an attacker to capture a single side-channel trace through power analysis or timing attacks. Using Deep Learning Side-Channel Analysis techniques, the attacker can recover the mnemonic phrase and compromise the wallet's cryptographic keys, leading to complete asset theft. The CVSS score of 4.6 reflects the physical access requirement but acknowledges high confidentiality impact. There is no evidence of active exploitation or public exploit code availability. The vulnerability is not tracked on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. However, the patch availability across affected Trezor versions indicates the issue has been remediated, and users running updated firmware are no longer at risk.