CVE-2026-24148

Estado: AnalizadaCrítica (9.4)—

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Puntuación base: 9.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.35%
Percentil entre todas las CVEs puntuadas: 26
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access60 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

Nvidia — Jetson Linux

CWE

CWE-1188

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-24148",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24148",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-01T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@nvidia.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.4,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@nvidia.com",
      "affectedData": [
        {
          "vendor": "NVIDIA",
          "product": "Jetson Xavier Series and Jetson Orin Series",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 35.6.4"
            }
          ],
          "platforms": [
            "Jetson Linux(35)"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "NVIDIA",
          "product": "Jetson Xavier Series and Jetson Orin Series",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 36.5"
            }
          ],
          "platforms": [
            "Jetson Linux(36)"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-31T17:16:29.180",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24148",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "psirt@nvidia.com"
    },
    {
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@nvidia.com"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24148",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "psirt@nvidia.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@nvidia.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID."
    },
    {
      "lang": "es",
      "value": "NVIDIA Jetson para JetPack contiene una vulnerabilidad en la lógica de inicialización del sistema, donde un atacante no privilegiado podría causar la inicialización de un recurso con un valor predeterminado inseguro. Un exploit exitoso de esta vulnerabilidad podría conducir a la revelación de información de datos cifrados, manipulación de datos y denegación de servicio parcial en dispositivos que comparten la misma ID de máquina."
    }
  ],
  "lastModified": "2026-07-24T20:10:00.147",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B73BF007-6D88-4803-B94B-647CCEC5E291",
              "versionEndExcluding": "35.6.4"
            },
            {
              "criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23FF116C-64BD-4F4D-960F-92A289CB8150",
              "versionEndExcluding": "36.5",
              "versionStartIncluding": "36.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_32gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D196FDF9-FC0F-4411-826D-5A7416F26159"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_64gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2392844C-6B11-41EA-A280-3AF1BDB77DC2"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_developer_kit:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8A7F9D64-EA34-4309-8B2B-293346BD6D25"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_industrial:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "211E860F-BEFF-4407-967B-3C1332268D8E"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4F92D471-8E65-41FC-A5DE-255136F6F989"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_64gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B51F666B-F3ED-4CF3-B48E-B39BDE1C2579"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_industrial:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3C7C6B22-EBD3-4465-9852-4A4844AA714A"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_4gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "80DA8F1E-9ED6-476A-9C9F-3DC231E5142D"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_8gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DD549248-1C2C-4A0C-9822-691F3D77AEB1"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_super_developer_kit:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6F4ECB54-9725-4BFA-A9E7-2F24EAE5BDAB"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_16gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6D96D5C9-4F9F-4487-90B9-0D8D473D4C6B"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_8gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E3CF8EB6-767C-43F8-A327-A2D4A91A7CF1"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_16gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A36028A3-EE83-4158-9039-5C6C795FA048"
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_8gb:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "22852BE0-B587-48B4-A7B6-6496715C32EF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@nvidia.com"
}