CVE-2025-15645 - CVE House
Back to Database
Status published Medium CVE-2025-15645

Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service

Vulnerability Description

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15645

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Guanxing Wen
  • VulnCheck

References

More from Ledger

View All →
CVE-2023-7346
Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript
Medium 4.1
CVE-2023-7345
Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation
Medium 6.9
CVE-2017-2808
An exploitable use-after-free vulnerability exists in the account parsing component...
High 7.5
CVE-2017-2807
An exploitable buffer overflow vulnerability exists in the tag parsing...
High 7.5

Affected Vendor

Affected Software

Ledger Nano X, Ledger Flex, Ledger Stax
Vulnerable Versions:
0

Timeline

Official Publish: May 19th, 2026
Last Modified: July 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-1284

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.