CVE-2023-7345 — Ledger Live with vulnerable versions of ledgerhq/hw-app-eth

title: Potential EIP-712 Typed Data Manipulation Attempt (CVE-2023-7345)
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
  This rule detects the execution of Ledger Live with a command line argument that could be indicative of an attempt to exploit CVE-2023-7345. The vulnerability lies in the incorrect hexadecimal field parsing of EIP-712 typed data messages within vulnerable versions of ledgerhq/hw-app-eth. Attackers can leverage this to trick users into signing unintended transactions. The '--unsafe-perm' flag, while not directly part of the exploit, can be associated with processes that might be targeted or used in conjunction with such vulnerabilities to gain elevated privileges or execute malicious code.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2023-7345/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'ledger-live'
      CommandLine|contains:
          - '--unsafe-perm'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse