CVE-2025-15645
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code, causing an unrecoverable fault state during boot and permanent loss of operability.
Risk Assessment
An attacker can permanently brick the device, rendering it unusable and requiring physical replacement.
Recommendation
Update the device firmware to the latest version if a patch is available.
Original NVD description (English source)
Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.