CVE-2025-69893 identifies a side-channel vulnerability in the BIP-39 mnemonic processing of Trezor hardware wallets versions 1.13.0 to 1.14.0. The vulnerability stems from the BIP-39 standard's non-constant time execution and branching patterns during mnemonic word searching, which leak information through side channels. An attacker with physical access during the wallet's initial setup phase can obtain a single side-channel trace. Using profiling-based deep learning side-channel analysis (DL-SCA), the attacker can extract the mnemonic phrase, compromising wallet security. The vendor has released patches to address this vulnerability.

If exploited, this vulnerability allows an attacker with physical access during the initial setup phase to recover the wallet's mnemonic phrase via side-channel analysis, enabling theft of the wallet's assets. The attack requires physical access and specialized analysis techniques. There are no known exploits in the wild. The vendor has patched the issue, mitigating the risk for updated devices.

The vulnerability has been patched by the vendor. Users should update their Trezor hardware wallets to versions later than 1.14.0 to ensure the fix is applied. No additional mitigation is required if the device is updated. For devices that cannot be updated, avoid exposing the device to untrusted physical access during the initial setup phase.