CVEs-PoC/2020/CVE-2020-6861.md

CVE-2020-6861

Description

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC.

POC

Reference

• https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html

Github

• https://github.com/0xT11/CVE-POC
• https://github.com/ARPSyndicate/cvemon
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/ph4r05/ledger-app-monero-1.42-vuln
• https://github.com/soosmile/POC