CyberRota Analysis
AI-GeneratedTrezor Safe 3, Safe 5, and Safe 7 firmware are vulnerable due to a confirmation-binding flaw in the Ethereum transaction signing process, where only the initial calldata chunk is confirmed, allowing an attacker to manipulate the transaction by altering the subsequent data. This could lead to unauthorized transactions if a victim unknowingly signs a malicious contract. Users of affected Trezor devices, particularly those engaging in Ethereum transactions, should prioritize applying the fix to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata to a victim then supply a different tail that changes the signed transaction. Fixed in 70c9b0c.