Flawed Protocol Design in Ledger Monero App for Ledger Nano and Ledger S
CVE-2020-6861
5.5MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-6861?
The Ledger Monero app prior to version 1.5.1 exhibits a vulnerability stemming from a flawed protocol design that could be exploited by a local attacker. By sending specifically crafted messages to the app, which must be selected on a Ledger device that is connected to a host PC and secured with a PIN, an attacker may extract the master spending key. This issue highlights the importance of robust protocol designs to safeguard sensitive cryptocurrency keys against unauthorized access.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.