Jetson Xavier Series Jetson Orin Series And Jetson Thor CVE-2026-24153

This vulnerability presents moderate real-world risk despite the 5.2 CVSS score. The CVSS vector (AV:P/AC:L/PR:L/UI:N/S:C) indicates physical attack surface, low complexity exploitation, and requirement for low-level authenticated access; these constraints significantly narrow the threat actor pool to insiders, service technicians, or those with direct hardware manipulation capability. The 5.2 score reflects high confidentiality impact (C:H) but zero integrity or availability impact, limiting exposure to information disclosure scenarios. Absence of CISA KEV status, public POC, or known active exploitation suggests this is a discovered vulnerability without yet-documented weaponization; however, the trusted application exposure (nvluks) could enable persistent attacks if exploited to exfiltrate encryption keys. Priority should be contextualized by deployment environment: air-gapped or tightly controlled Jetson fleets face lower risk than open-access edge devices.

A technician with legitimate low-level access to a Jetson device opens the physical enclosure and boots the device, then interacts with the improperly-guarded nvluks trusted application through low-level device interfaces (e.g., secure monitor calls) to extract encryption keys or sensitive cryptographic material stored in the TEE. This requires physical proximity and authenticated system access, limiting exploitation to insider threats or highly targeted supply-chain scenarios. No public exploit code is documented, making this a theoretical threat requiring either reverse engineering of the nvluks TA or leaked POC code.