PatchTheCVECVE-2019-14354: On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found
CVE-2019-14354 is a low-severity flaw (CVSS 2.4) affecting nano s firmware, nano x firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only i
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 2.4 (Low) |
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 71%) |
| CISA exploited list | No |
| Weakness | CWE-203 |
| Published | 2019-08-10 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-14354?
nano s firmware: mitigate or apply the listed mitigation; nano x firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-14354 being exploited?
CVE-2019-14354 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-14354 affect?
CVE-2019-14354 affects nano s firmware, nano x firmware. Severity is low (CVSS 2.4). On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents
How urgent is CVE-2019-14354?
Priority 16/100. No elevated risk signals yet.