Description (CNA)
Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ledger / Ledger Nano X | affected 0 before 2.4.2 |
| Ledger / Ledger Flex | affected 0 before 1.2.2 |
| Ledger / Ledger Stax | affected 0 before 1.6.2 |
CWE
CWE-1284
References
- https://donjon.ledger.com/lsb/021/
- https://www.vulncheck.com/advisories/ledger-nano-x-flex-stax-mcu-firmware-update-denial-of-service
ADP enrichment
No English description supplied.
No references supplied.