Description
Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Ledger Ledger Nano X
Default version status: unaffected
0 to < 2.4.2affected
Ledger Ledger Flex
Default version status: unaffected
0 to < 1.2.2affected
Ledger Ledger Stax
Default version status: unaffected
0 to < 1.6.2affected