Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-23660 Details

Description

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA: CISA-ADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://milksad.info/posts/research-update-5/ CVEExploitThird Party Advisory
https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/ CVEExploitThird Party Advisory
https://milksad.info/posts/research-update-5/ [email protected]ExploitThird Party Advisory
https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/ [email protected]ExploitThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)[email protected]
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)CISA-ADP

Affected Products

ProductVersions
binance trust wallet
0.0.4

CPE

  • cpe:2.3:a:binance:trust_wallet:0.0.4:*:*:*:*:iphone_os:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-23660
NVD Published Date:
Feb 8, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]