CVE-2025-15645

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://donjon.ledger.com/lsb/021/
https://www.vulncheck.com/advisories/ledger-nano-x-flex-stax-mcu-firmware-update-denial-of-service

Configurations

No configuration.

History

24 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Los dispositivos Ledger Nano X, Flex y Stax contienen una vulnerabilidad de denegación de servicio en el proceso de actualización del firmware del MCU debido a la falta de validación del parámetro reset_handler durante el flasheo del firmware. Un atacante puede proporcionar una dirección reset_handler manipulada que apunte a memoria inválida o a código controlado por el atacante para hacer que el dispositivo entre en un estado de fallo irrecuperable durante el arranque, lo que resulta en la pérdida permanente de operatividad.

20 May 2026, 14:16

Type	Values Removed	Values Added
References	~~{'url': 'https://www.ledger.com/security-bulletin', 'source': 'disclosure@vulncheck.com'}~~	() https://donjon.ledger.com/lsb/021/ -

19 May 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-19 22:16

Updated : 2026-07-24 09:10

NVD link : CVE-2025-15645

Mitre link : CVE-2025-15645

CVE.ORG link : CVE-2025-15645

JSON object : View

Products Affected

No product.

CWE

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2025-15645", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15645", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T14:43:51.214475Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Ledger", "product": "Ledger Nano X", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Ledger", "product": "Ledger Flex", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Ledger", "product": "Ledger Stax", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-19T22:16:36.187", "references": [{"url": "https://donjon.ledger.com/lsb/021/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ledger-nano-x-flex-stax-mcu-firmware-update-denial-of-service", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability."}, {"lang": "es", "value": "Los dispositivos Ledger Nano X, Flex y Stax contienen una vulnerabilidad de denegaci\u00f3n de servicio en el proceso de actualizaci\u00f3n del firmware del MCU debido a la falta de validaci\u00f3n del par\u00e1metro reset_handler durante el flasheo del firmware. Un atacante puede proporcionar una direcci\u00f3n reset_handler manipulada que apunte a memoria inv\u00e1lida o a c\u00f3digo controlado por el atacante para hacer que el dispositivo entre en un estado de fallo irrecuperable durante el arranque, lo que resulta en la p\u00e9rdida permanente de operatividad."}], "lastModified": "2026-07-24T09:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}