All articles

Past security issues

Collection of security issues found both internally and externally. For a more in-depth look at each issue, learn more at GitHub: Past Security Issues

Security Issues

VulnerabilityDate ReportedNotesDetails
Missing confirmation screen in the ECDHSessionKey call2023-11-26Impact: Skipped confirm on TS3<br> Severity: Medium<br> Fix: Firmware 2.6.4 for Trezor Safe 3<br> Reported By: Mathias HerbertsGitHub
XSS in Trezor Connect legacy versions2023-02-07Impact: Possible phishing attack<br> Severity: Medium<br> Scalability: Remote (Interaction)<br> Reported By: Jun KokatsuGitHub
Insufficient field size check in Protobuf2021-07-12Impact: Theft of Funds<br> Severity: Critical<br> Scalability: Remote (Interaction)<br> Fix: Firmware 1.10.3<br> Reported By: Stellar Development FoundationGitHub
Read Protection Downgrade Attack-Impact: Seed Exposure<br> Scalability: Local invasive<br> Reported By: KrakenGitHub
Monero unlock_time issue2020-02-01Impact: Destruction of Funds<br> Severity: High<br> Scalability: Remote (Interaction)<br> Fix: Firmware 2.3.0<br> Reported By: Sebastian KungGitHub
Possible large transaction fee via two Segwit transactions2020-03-03Impact: Destruction of Funds<br> Severity: High<br> Scalability: Remote (Interaction)<br> Fix: Firmware 1.9.1 for Model One and 2.3.1 for Model T<br> Reported By: Saleem RashidGitHub
Malicious change in mixed transactions2020-03-07Impact: Theft of Funds<br> Severity: Critical<br> Scalability: Remote (Interaction)<br> Fix: Firmware 2.3.0<br> Reported By: Saleem RashidGitHub
OP_RETURN treated as change output2020-03-02Impact: Theft of Funds<br> Severity: Critical<br> Scalability: Remote (Interaction)<br> Fix: 1.9.0 + 2.3.0<br> Reported By: Saleem RashidGitHub
Malicious change in mixed transactions2019-10-01Impact: Theft of Funds<br> Severity: Critical<br> Scalability: Remote (Interaction)<br> Fix: Firmware 2.1.8<br> Reported By: Marko BencunGitHub
Information leak via OLED display2019-04-08Impact: TBD<br> Severity: TBD<br> Scalability: Local (Non-invasive)<br> Fix: Firmware 1.8.2<br> Reported By: Christian ReitterGitHub
Secret information leak via USB Descriptors2019-01-02Impact: Seed Exposure<br> Severity: High<br> Scalability: Local (Non-invasive)<br> Fix: Firmware 1.8.0 for Model One and 2.1.0 for Model T<br> Reported By: Colin O'FlynnGitHub
SRAM dump via glitching the firmware update2018-12-27Impact: Seed Exposure<br> Severity: Moderate<br> Scalability: Local (Destructive)<br> Fix: Firmware 1.8.0<br> Reported By: wallet.failGitHub
Side-channel analysis (SCA) of PIN comparison2018-10-31Impact: Theft of Funds<br> Severity: Moderate<br> Scalability: Local (Destructive)<br> Fix: Firmware 1.8.0<br> Reported By: Charles GuillemetGitHub
Buffer overflow in bech32_decode/cash_decode2018-09-26Impact: Device freeze<br> Severity: None<br> Scalability: Remote (Interaction)<br> Fix: Firmware 1.7.1<br> Reported By: Christian ReitterGitHub
Buffer overflow in message processing2018-05-25Impact: Seed Exposure<br> Severity: High<br> Scalability: Local (Non-invasive)<br> Fix: Firmware 1.6.2<br> Reported By: Christian ReitterGitHub
STM32F205 write-protection issue2018-02-12Impact: -<br> Severity: -<br> Scalability: Supply Chain<br> Fix: Firmware 1.6.1<br> Reported By: Saleem RashidGitHub
Secret leak via SRAM residue2017-08-01Impact: Seed Exposure<br> Severity: Moderate<br> Scalability: Local (Destructive)<br> Fix: Firmware 1.5.2<br> Reported By: SunnyGitHub
Possible key extraction with oscilloscope2015-03-26Impact: Key Exposure<br> Severity: High<br> Scalability: Local (Non-invasive)<br> Fix: Firmware 1.3.3<br> Reported By: Jochen HoenickeGitHub
Malicious change in mixed transactions2015-02-23Impact: Theft of Funds<br> Severity: Critical<br> Scalability: Remote (Interaction)<br> Fix: Firmware 1.3.1<br> Reported By: Nicolas BaccaGitHub
;