VulnSocial

CVE-2023-7346Patch

LOWCVSS 4.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-682

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-20: 1Patch / Workaround · 2026-05-20: 1Technical Details · 2026-05-20: 105-20
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • ProjetoLabo@ProjetoLabo
    Patch

    SEU LEDGER MOSTROU O ENDEREÇO ERRADO O CVE-2023-7346 saiu hoje no NVD. As versões 2.1.0 e 2.1.1 do app Bitcoin da Ledger mostravam endereços errados por um fragmento de miniscript mal implementado. Kevin Loaec e Antoine Poinsot encontraram a falha pelo bounty da Ledger, a correção veio na 2.1.2. O impacto foi pequeno porque ninguém usava a função afetada, mas o conceito assusta. Você compra um hardware wallet para ter uma tela confiável, e se a tela mostra o endereço errado, o dispositivo perde o sentido. Quantos outros bugs de derivação de endereço estão esperando? #Ledger #CVE

    Post summary

    CVE‑2023‑7346 was discovered via a bounty, involving a miniscript flaw that caused incorrect address display. The Ledger app fixed the issue in release 2.1.2, and the impact is reported as minor.

    01011122
    172 followersView on X

Explore more

Back to dashboard