Vulnerabilities

TI-2026-46466 CVE-2026-65058 · GHSA-6552-m3hr-mqwj

Trezor Safe improper security check in on-device display

LOW 27

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00398 Published 2026-07-21 Fixed in 70c9b0c CWE-358

TI-2020-13336 CVE-2020-18172 · GHSA-frh8-qg35-vhhg

MEDIUM 45

A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0134 Published 2021-07-26 No fix listed CWE-94

TI-2019-10697 CVE-2019-14353 · GHSA-x6r2-975h-mhpr

LOW 20

On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found.

CVSS 3.0MEDIUM 4.2 Physical No auth No interaction EPSS 0.00374 Published 2019-08-08 No fix listed CWE-203