EUVD-2026-72300
GHSA-q9vx-6fw9-4mv8
Severity by source
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access and specialized hardware tooling required (AV:P/AC:H); scope changes as the encrypted XIP application code itself is the compromised asset (S:C), with full C/I/A impact if decryption is bypassed.
Primary rating from Vendor (YesWeHack).
CVSS VectorVendor: YesWeHack
Lifecycle Timeline
2DescriptionCVE.org
Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme.
AnalysisAI
The nRF5340 SoC's on-the-fly QSPI flash decryption scheme for Execute-in-Place (XIP) contains a cryptographic architectural weakness that allows a physically-present attacker to undermine the confidentiality and integrity of externally stored encrypted firmware. Applications built on the nRF5340 that use external QSPI flash for encrypted XIP and rely on that encryption for firmware IP protection or tamper resistance are affected regardless of nRF Connect SDK version, as the root cause is in the SoC's hardware decryption block. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires physical access to the target nRF5340 device (CVSS AV:P confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:P/AC:H/AT:P) accurately reflects the high barrier to exploitation: physical device access, high attack complexity (specialized hardware tooling such as QSPI bus interposers and logic analyzers), and the specific prerequisite (AT:P) that the target application must actually use encrypted external QSPI XIP. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No software patch resolves the root-cause hardware architectural weakness; developers should consult Nordic Semiconductor's security advisory at https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html for official guidance and any available mitigations or errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today