CVE-2025-23270

highpriority · track · 0EPSS 0.002 · 13 %ileEURU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.22% (13th) EPSS

CVSS 7.1 · high

Is it mine?

8 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

EPSS · scored 2026-10-27

NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a side channel vulnerability. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1

v3.17.1highAV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.1highCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.1highCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · psirt@nvidia.comexploitability 0.5 · impact 6

v3.16.5mediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-392USCWE-392US

affected products (8)

Products and version ranges known to be affected.

NVIDIA Jetson Orin, IGX Orin and Xavier Devices≤ IGX Orin All versions prior to IGX 1.1.2enisa_euvdEU
NVIDIA Jetson Orin, IGX Orin and Xavier Devices≤ NVIDIA Jetson Orin Series All versions prior to JP6.x: 36.4.4enisa_euvdEU
NVIDIA Jetson Orin, IGX Orin and Xavier Devices≤ NVIDIA Jetson Orin Series All versions prior to JP5.x: 35.6.2enisa_euvdEU
NVIDIA Jetson Orin, IGX Orin and Xavier Devices≤ NVIDIA Xavier Series All versions prior to JP5.x: 35.6.2enisa_euvdEU
NVIDIA Corp. NVIDIA IGX Orin≤ IGX 1.1.2fstec_bduRU
NVIDIA Corp. NVIDIA Jetson Orin Series≤ JP5.x: 35.6.2fstec_bduRU
NVIDIA Corp. NVIDIA Jetson Orin Series≤ JP6.x: 36.4.4fstec_bduRU
NVIDIA Corp. NVIDIA Xavier Series≤ JP5.x: 35.6.2fstec_bduRU

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2025-07-17modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan