CVE-2023-7345
📛 CVE Title
(no title)
Description
Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- medium
- CVSS score
- 6.5 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N- Effective score
- 6.5 / 10 MEDIUM source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2023-7345
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-19 22:16:35 UTC
- NVD last modified
- 2026-05-20 14:16:35 UTC
- NVD CVSS v3.1
- 6.5 / 10 MEDIUM source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 3.6 / 10
- EPSS score
- 0.0003 (probability of exploitation in next 30 days)
- EPSS percentile
- 8.59% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-704
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:10 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-60576 - Assigner
- VulnCheck
- Published
- May 19, 2026, 9:55:51 PM
- Updated
- May 20, 2026, 5:20:12 PM
- EUVD base score (CVSS 4.0)
-
6.9 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.0300
- Vendors
- Ledger
- Products
-
Ledger Live (0 <2.70.0)ledgerhq/hw-app-eth (0 <6.34.7)
- Aliases
-
GHSA-m3cf-54jv-7mmj
ENISA description: Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://donjon.ledger.com/lsb/020/ tenable:donjon.ledger.com
- https://nvd.nist.gov/vuln/detail/CVE-2023-7345 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2023-7345 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
- https://www.vulncheck.com/advisories/ledger-live-hw-app-eth-eip-712-message-parsing-integer-truncation tenable:www.vulncheck.com
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://donjon.ledger.com/lsb/020/ disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/ledger-live-hw-app-eth-eip-712-message-parsing-integer-truncation disclosure@vulncheck.com
Remediations (10)
-
web:blog.qualys.com
Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 309 security vulnerabilities.
2026-05-26 03:08 UTC -
web:github.com
Description Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended ...
2026-05-26 03:08 UTC -
web:guide.sonatype.com
Technical security analysis for CVE-2023-7345 . CVSS 6.9 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.
2026-05-26 03:08 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-26 03:08 UTC -
web:source.android.com
This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.
2026-05-26 03:08 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-05-26 03:08 UTC -
web:www.microsoft.com
Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.
2026-05-26 03:08 UTC -
web:www.oracle.com
Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.
2026-05-26 03:08 UTC -
web:www.tenable.com
Synopsis The remote host is missing several patches. Description The remote host is missing one or more security patches. This plugin lists the newest version of each patch to install to make sure the remote host is up-to-date. Note: Because the 'Show missing patches that have been superseded' setting in your scan policy depends on this plugin, it will always run and cannot be disabled ...
2026-05-26 03:08 UTC -
web:www.virustotal.com
VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.
2026-05-26 03:08 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.