CVE-2023-25758: Medium severity onekey touch vulnerability
Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device (i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP network). NOTE: the vendor states that "our hardware team has updated the security patch without anyone being affected."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25758?
CVE-2023-25758 has been classified as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2023-25758?
To mitigate CVE-2023-25758, it is essential to update Onekey Touch devices to firmware version 4.0.1 or higher and Onekey Mini devices to firmware version 2.10.1 or higher.
What types of devices are affected by CVE-2023-25758?
CVE-2023-25758 affects Onekey Touch devices with firmware version 4.0.0 and earlier, and Onekey Mini devices with firmware version 2.10.0 and earlier.
What can a man-in-the-middle attacker do with CVE-2023-25758?
A man-in-the-middle attacker can obtain the seed phase from the affected Onekey devices, compromising user security.
Is CVE-2023-25758 risk limited to specific usage conditions?
Yes, the risk associated with CVE-2023-25758 requires physical access to the device, as it involves disassembly.