CVE-2025-15645: Ledger Nano X, невалидиран вход

Описание

Оригинално описание

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

Засегнати продукти

• Ledger Ledger Nano X: преди 2.4.2
• Ledger Ledger Flex: преди 1.2.2
• Ledger Ledger Stax: преди 1.6.2

Вид слабост

• CWE-1284 Improper Validation of Specified Quantity in Input

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2025-15645
• https://nvd.nist.gov/vuln/detail/CVE-2025-15645
• https://donjon.ledger.com/lsb/021/
• https://www.vulncheck.com/advisories/ledger-nano-x-flex-stax-mcu-firmware-update-denial-of-service