What is the CVSS score of CVE-2025-69893?

CVE-2025-69893 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Trezor One CVE-2025-69893

EUVD-2025-209448 MEDIUM

Covert Timing Channel (CWE-385)

2026-04-14 cve@mitre.org

GHSA-fxwp-fxmc-jh57

Information Disclosure

4.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 16, 2026 - 13:22 NVD

4.6 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 15:22 euvd

EUVD-2025-209448

CVE Published

Apr 14, 2026 - 15:16 nvd

MEDIUM 4.6

DescriptionCVE.org

A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard guidelines, which induce non-constant time execution and specific branch patterns for word searching. An attacker with physical access during the initial setup phase can collect a single side-channel trace. By utilizing profiling-based Deep Learning Side-Channel Analysis (DL-SCA), the attacker can recover the mnemonic code and subsequently steal the assets. The issue was patched.