CVE-2020-6861

MEDIUM 5.5CVE-2020-6861 · Published 06/05/2020 · updated 17/06/2026

In short

CVE-2020-6861 is a MEDIUM (CVSS 5.5) vulnerability affecting monero (ledger).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.5% of all vulnerabilities.
Fix: update to 1.5.1 or later.

Package	Affected versions	Patched versions
monero ledger	`< 1.5.1`	`1.5.1`

Description

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC.

References

deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html · Exploit
donjon.ledger.com/lsb/008 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free