Ledger Nano X, Flex, and Stax devices have a denial of service flaw in the MCU firmware update routine. The vulnerability arises from missing validation of the reset_handler parameter during firmware flashing, and it is categorized as CWE-1284. An attacker who can supply a crafted reset_handler address can trigger the device to enter an unrecoverable fault state each time it boots, leading to permanent loss of functionality.

The affected hardware is Ledger’s line of crypto‑wallet devices: Ledger Nano X, Ledger Flex, and Ledger Stax. No specific firmware version numbers are listed, so any installation of these models that has not applied the current firmware update is potentially vulnerable.

The CVSS score of 5.1 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is physical or privileged access to the device’s firmware update channel, inferred from the requirement that the attacker must orchestrate a firmware flash. The attack likely requires the attacker to use a compromised software update channel or a maliciously crafted firmware image. Because the vulnerability is tied to the device’s update mechanism, it is not a remote network‑exposed flaw.