Read the docs

Ledger

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Ledger records in CISA KEV

No Ledger vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ledger Live 1 record LOW Monero 1 record LOW Nano S Firmware 1 record LOW Nano X Firmware 1 record LOW

Records

8 records

TI-2017-02028 CVE-2017-2807 · GHSA-59vm-28w2-496w

Memory corruption in Ledger CLI

Priority LOW 38

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.01974 Published 2017-09-05 No fix listed CWE-119
TI-2017-02029 CVE-2017-2808 · GHSA-9329-p7mv-f8p5

Use after free in Ledger CLI

Priority LOW 37

An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.01709 Published 2017-09-05 No fix listed CWE-416
TI-2023-06709 CVE-2023-7345 · GHSA-m3cf-54jv-7mmj

Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation

Priority LOW 30

Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal fi…

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00263 Published 2026-05-19 Fixed in 6.34.7, 2.70.0 CWE-704
TI-2020-05566 CVE-2020-6861 · GHSA-hpg2-wgv6-vgm5

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger…

Priority LOW 25

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-ent…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00441 Published 2020-05-06 No fix listed CWE-327
TI-2025-14269 CVE-2025-15645 · GHSA-jj3m-33jh-v459

Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service

Priority LOW 23

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing.

CVSS 4.0MEDIUM 5.1 Physical No auth No interaction EPSS 0.0021 Published 2026-05-19 Fixed in 2.4.2, 1.2.2 +1 CWE-1284
TI-2023-06710 CVE-2023-7346 · GHSA-329m-69cj-4486

Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript

Priority LOW 18

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies co…

CVSS 4.0MEDIUM 4.1 Physical No auth User interaction EPSS 0.0014 Published 2026-05-20 Fixed in 2.1.2 CWE-682
Open these records in search →