CVE-2023-7346

Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript

CVSS 4.1 MEDIUMEPSS 0.1%CWE-682

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

20 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Ledger · Ledger Bitcoin app

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://donjon.ledger.com/lsb/019/https://www.vulncheck.com/advisories/ledger-bitcoin-app-address-derivation-error-via-miniscript