PT-2026-42019 · Ledger · Hw-App-Eth

Ian Fisher + 1 · Published 2026-05-19 · Updated 2026-05-20 · CVE-2023-7345

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ledgerhq/hw-app-eth versions prior to 6.34.7

Description An integer parsing issue exists where incorrect hexadecimal field parsing occurs when values contain an odd number of characters. This allows attackers to manipulate EIP-712 typed data messages, enabling them to obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers for incorrect amounts.

Recommendations Update ledgerhq/hw-app-eth to version 6.34.7 or later.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2023-7345

Affected Products

Hw-App-Eth

References · 7

• https://donjon.ledger.com/lsb/020 · Vendor Advisory
• https://ledger.com/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7345 · Security Note
• https://t.me/CVEtracker/54288 · Telegram Post
• https://t.me/cveNotify/164220 · Telegram Post
• https://vulncheck.com/advisories/ledger-live-hw-app-eth-eip-712-message-parsing-integer-truncation · Note
• https://twitter.com/CVEnew/status/2056870169742303381 · Twitter Post