Ledger MCU firmware update flaw could permanently brick Nano X, Flex and Stax

Ledger’s security bulletin LSB-021 describes a flaw in the update process for the MCU firmware of the Ledger Nano X, Flex and Stax. During an update, the bootloader takes a reset_handler address from the host computer that tells the device where to resume execution once flashing is complete. According to Ledger, the bootloader did not validate this value.

Ledger states that a crafted address could point either to invalid memory or to code controlled by the attacker. In the first case the device could enter an unrecoverable fault state at boot: both external interfaces stop responding and, according to the bulletin, the device cannot be restored without specialised tools and factory-level access. Ledger attributes the flaw to missing basic checks such as range, alignment and signature validation, and states that the impact is limited to device operability and that client funds have never been at risk.

Ledger states that it fixed the issue by strictly validating the reset_handler field and making the command part of the signed communication flow, in Nano X firmware 2.4.2, Flex 1.2.2, Stax 1.6.2 and later releases. The issue was reported by Guanxing Wen through Ledger’s bug bounty programme.

Ledger published LSB-021 on 10 January 2025; the bulletin gives no report or fix dates. On 19 May 2026 VulnCheck published CVE-2025-15645 for the same flaw, describing it as a denial-of-service issue that requires physical access, rated medium, affecting Nano X before 2.4.2, Flex before 1.2.2 and Stax before 1.6.2.

What Ledger advises:

• Keep the device firmware up to date.