Is CVE-2019-14353 actively exploited?

No active exploitation of CVE-2019-14353 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-14353 be exploited remotely?

No. CVE-2019-14353 requires physical access to exploit.

What is the CVSS score of CVE-2019-14353?

CVE-2019-14353 has a CVSS score of 4.2 (MEDIUM).

HOME VULNERABILITIESCVE-2019-14353

MEDIUM

CVE-2019-14353

CWE-203Published: August 8, 2019· Updated: Jun 17, 2026

4.2

CVSS v3.1

Official Description

On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: this CVE applies exclusively to the Trezor One, and does not refer to any issues with OLED displays on other devices.

NVD Source

Technical Analysis

CVE-2019-14353 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 4.2.