CVE-2025-15645 — Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service
Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter durin…
Published: 2026-05-19 · CVSS: 5.1 · CVSS 4.0
Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7