Vulnerability · Published May 19, 2026 · Assigned by VulnCheck

CVE-2025-15645Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service

Medium 4.6

In plain English

A medium-severity security flaw in Ledger Flex from Ledger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

Affected products (as reported)

Vendor	Product	Versions
Ledger	Ledger Nano X	0 – before 2.4.2
Ledger	Ledger Flex	0 – before 1.2.2
Ledger	Ledger Stax	0 – before 1.6.2

Weakness: CWE-1284 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Ledger Security Bulletin 021 vendor-advisory
https://www.vulncheck.com/advisories/ledger-nano-x-flex-stax-mcu-firmware-update-denial-of-service third-party-advisory