CVE-2023-25758

Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device (i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP network). NOTE: the vendor states that "our hardware team has updated the security patch without anyone being affected."

• https://blog.onekey.so/our-response-to-recent-security-fix-reports-13914fea8afdVendor Advisory
• https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardware-security/amp/Third Party Advisory
• https://github.com/OneKeyHQ/firmwareProduct
• https://blog.onekey.so/our-response-to-recent-security-fix-reports-13914fea8afdVendor Advisory
• https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardware-security/amp/Third Party Advisory
• https://github.com/OneKeyHQ/firmwareProduct

Published

Feb 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25752When accessing throttled streams, the count of available byt…6.5
• CVE-2023-25753 There exists an SSRF (Server-Side Request Forgery) vulnerab…6.5
• CVE-2023-25754Privilege Context Switching Error vulnerability in Apache So…9.8
• CVE-2023-25755Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is…7.8
• CVE-2023-25756Out-of-bounds read in the BIOS firmware for some Intel(R) Pr…8
• CVE-2023-25757Improper access control in some Intel(R) Unison(TM) software…7.2
• CVE-2023-25759OS Command Injection in TripleData Reporting Engine in Tripl…5.4
• CVE-2023-2576An issue has been discovered in GitLab CE/EE affecting all v…4.3
• CVE-2023-25760Incorrect Access Control in Tripleplay Platform releases pri…8.8
• CVE-2023-25761Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does no…5.4
• CVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does no…5.4
• CVE-2023-25763Jenkins Email Extension Plugin 2.93 and earlier does not esc…5.4