This vulnerability involves side-channel leakage in the BIP-39 mnemonic processing of Trezor hardware wallets (One, T, Safe) versions 1.13.0 to 1.14.0. The BIP-39 standard's non-constant time word search implementation creates exploitable timing and branching patterns. An attacker with physical access during device setup can obtain a side-channel trace and apply profiling-based deep learning side-channel analysis (DL-SCA) to extract the mnemonic phrase, compromising wallet security. The vulnerability has been addressed in subsequent firmware updates.

Successful exploitation allows an attacker with physical access during the initial setup phase to recover the wallet's mnemonic phrase, enabling theft of the wallet's assets. The vulnerability does not affect confidentiality, integrity, or availability beyond the mnemonic compromise. There are no known exploits in the wild.

The vulnerability has been patched by the vendor. Users should update their Trezor hardware wallets to versions later than 1.14.0 to mitigate this issue. No additional mitigation steps are indicated.