CVE-2020-6861

low-risk

Published 2020-05-06

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC.

Do I need to act?

0.59% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Monero

Affected Vendors

Ledger

References (4)

Exploit https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html

Exploit https://donjon.ledger.com/lsb/008/

Exploit https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html

Exploit https://donjon.ledger.com/lsb/008/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal