EUVD-2026-17514Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.
AnalysisAI
Command injection in NVIDIA Jetson Linux initrd allows physical attackers to execute arbitrary code with elevated privileges across Jetson Xavier, Orin, and Thor series devices. An attacker with physical access can inject malicious command-line arguments during boot without authentication (CVSS:3.1/AV:P/AC:L/PR:N), leading to complete system compromise including root-level code execution, denial of service, and data exfiltration. EPSS data not available; no public exploit identified at time of analysis, though the low attack complexity (AC:L) and physical-only requirement (AV:P) suggest exploitation is straightforward for adversaries with device access.
Technical ContextAI
This vulnerability affects the initrd (initial ramdisk) component of NVIDIA Jetson Linux, a Debian-based operating system running on NVIDIA Jetson embedded AI computing platforms including Xavier, Orin, and Thor series modules. The flaw is classified as CWE-78 (OS Command Injection), indicating improper neutralization of special elements in commands passed to the operating system shell during the boot process. The initrd is responsible for early-stage boot operations before the main filesystem is mounted, making it a critical trust boundary. The vulnerability permits command-line argument manipulation at this privileged boot stage, bypassing typical runtime security controls. The CVSS vector indicates physical attack vector (AV:P) with low complexity (AC:L), no privileges required (PR:N), scope change (S:C), and high impact across confidentiality, integrity, and availability. The scope change suggests the attacker can affect resources beyond the vulnerable component's authorization scope, potentially escalating from boot-time injection to persistent system-level compromise.
RemediationAI
NVIDIA has published security bulletin 5797 addressing this vulnerability. Organizations should immediately apply the patched version of Jetson Linux available through NVIDIA's official channels-consult https://nvidia.custhelp.com/app/answers/detail/a_id/5797 for exact fixed versions and update procedures specific to Xavier, Orin, and Thor platforms. As an interim mitigation for environments where patching is delayed, implement physical security controls including tamper-evident enclosures, secure boot configurations with verified boot chains, TPM-based attestation where supported, and restricted physical access to deployed devices. For field deployments, consider hardware-based boot integrity mechanisms and monitoring for unexpected boot parameter modifications. Organizations should audit existing Jetson device deployments to identify units in physically accessible locations and prioritize remediation based on exposure risk. Supply chain security reviews should verify that devices have not been tampered with prior to deployment, particularly for newly acquired inventory.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today