A side‑channel vulnerability in the BIP‑39 mnemonic processing routine enables an attacker with physical access to the device during the very first use to extract the recovery phrase. The flaw originates from timing variations and branching paths in the word‑search algorithms defined by the BIP‑39 standard, allowing a single trace to be analyzed with deep‑learning techniques. Recovery of the mnemonic directly compromises the holder’s funds, as it provides full ownership of the wallet’s private keys.

The weakness affects Trezor One (firmware versions 1.13.0‑1.14.0), Trezor T (firmware 1.13.0‑1.14.0), and Trezor Safe (firmware 1.13.0‑1.14.0). The issue is limited to these firmware releases; newer revisions are not impacted.

Because the attack requires only a single side‑channel trace collected during the initial setup and relies on well‑known deep‑learning crypto‑analysis, the exploitation risk is moderate given the low CVSS score of 4.6, but recovery of the mnemonic directly compromises the wallet’s private keys. The EPSS score is below 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Security teams should still treat it as a concern and update firmware to the patched version.