What is the CVSS score of CVE-2026-24148?

CVE-2026-24148 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Nvidia are affected by CVE-2026-24148?

CVE-2026-24148 affects NVIDIA Jetson devices (Xavier and Orin series running JetPack) and allows authenticated attackers to decrypt sensitive data and modify system configurations across multiple…

How to fix or mitigate CVE-2026-24148?

Within 24 hours: Inventory all Jetson Xavier and Orin devices in production and document JetPack versions deployed. Within 7 days: Implement network segmentation to restrict authenticated access to Jetson devices and disable default credentials on all systems; contact NVIDIA support for patch timeline and interim guidance. Within 30 days: Deploy unique machine identifiers across all Jetson devices; regenerate any encryption keys or certificates that may have been protected by compromised default identifiers; conduct audit of device access logs for unauthorized activity.

Nvidia CVE-2026-24148

EUVD-2026-17510 HIGH

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-03-31 nvidia

Information Disclosure Denial Of Service Nvidia

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 17:16 euvd

EUVD-2026-17510

Analysis Generated

Mar 31, 2026 - 17:16 vuln.today

CVE Published

Mar 31, 2026 - 16:22 nvd

HIGH 8.3

DescriptionCVE.org

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.

AnalysisAI

NVIDIA Jetson system initialization flaw allows authenticated remote attackers to exploit insecure default machine IDs, enabling cross-device information disclosure of encrypted data and tampering. Affects JetPack on Xavier and Orin series devices. CVSS 8.3 (High) with network attack vector and low complexity. EPSS data not available; no confirmed active exploitation (CISA KEV status not present). The vulnerability enables attackers with low-level privileges to compromise multiple devices sharing identical default machine identifiers, undermining cryptographic protections and system integrity across the device fleet.

Technical ContextAI

This vulnerability (CWE-1188: Initialization of a Resource with an Insecure Default) resides in NVIDIA JetPack's system initialization logic for Jetson Xavier and Orin series embedded computing platforms. The flaw stems from insecure default machine ID generation or assignment during system bootstrap. Machine IDs typically serve as unique identifiers for cryptographic key derivation, device authentication, and session management. When multiple devices share identical default machine IDs due to improper initialization, cryptographic operations that depend on device uniqueness become compromised. An attacker exploiting this can decrypt data encrypted with keys derived from the shared machine ID, inject malicious data across the device cohort, or disrupt services by manipulating shared identity-based resources. The CPE strings indicate broad applicability across NVIDIA's Jetson Xavier and Orin product lines running affected JetPack versions, suggesting this is a systemic issue in the platform's identity management architecture rather than a single component bug.

RemediationAI

Apply the vendor-released security update detailed in NVIDIA Security Bulletin 5797 available at https://nvidia.custhelp.com/app/answers/detail/a_id/5797. The advisory should specify patched JetPack versions that correct the insecure machine ID initialization logic. Upgrading to the fixed JetPack release is the primary remediation path, ensuring proper unique machine ID generation during system initialization. After applying patches, organizations should verify that deployed Jetson devices have unique machine identifiers by auditing device configurations and cryptographic key material. In environments where immediate patching is infeasible, implement network segmentation to isolate Jetson devices from untrusted networks, enforce strict authentication controls to prevent low-privilege account compromise (mitigating PR:L attack requirement), and monitor for anomalous cross-device authentication or data access patterns that could indicate exploitation. Review and rotate any cryptographic keys or certificates that may have been derived from the insecure default machine IDs on previously deployed devices.