QSearchQSearch

CVE-2025-15645

4.6 MEDIUM

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validat...

Published: 2026-05-19 · Last updated: 2026-05-20

Severity and scoring

CVSS
4.6 MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-1284

Description

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-49110 — Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions (7.5 HIGH)
  • CVE-2026-49078 — Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions (7.5 HIGH)
  • CVE-2026-45441 — Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions (7.5 HIGH)
  • CVE-2026-42657 — Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions (5.3 MEDIUM)
  • CVE-2026-12059 — The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote attackers ... (8.8 HIGH)