CVE-2025-15645 is a denial of service vulnerability affecting Ledger Nano X, Flex, and Stax devices. It stems from improper validation of the reset_handler parameter in the MCU firmware update process. By providing a malicious reset_handler address during firmware flashing, an attacker can cause the device to fail permanently during boot, rendering it inoperable. This vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input). The CVSS 3.1 base score is 4.6, reflecting a medium impact primarily due to availability loss. No patch or vendor advisory indicating remediation is currently available.

The impact of this vulnerability is a permanent denial of service on affected Ledger hardware wallets. Exploitation causes the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability. There is no confidentiality or integrity impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid applying untrusted firmware updates and only use firmware provided directly by Ledger through official channels. Monitor Ledger's official communications for updates on remediation.