The vulnerability arises when the MCUBoot bootloader on Nordic Semiconductor nRF54H20 devices, using the Direct XIP update strategy, selects an unauthenticated slot for a secondary image. The bootloader assumes the presence of at least one slot per image is sufficient for a bootable system, causing mismatches between the main application slot and the radio core slot. As a result, after booting the main application, the radio core can be started with an address pointing to an unauthenticated slot. This permits the execution of code that has not been authenticated, compromising the device’s integrity and potentially enabling further attacks. The flaw is identified as CWE‑347, improper handling of input during boot.

This issue affects devices built with Nordic Semiconductor ASA’s nRF54H20 microcontroller that employ the Direct XIP update strategy. Vendor software that uses the upstream MCUBoot without patching for this behavior is impacted. No specific firmware version ranges are listed, so any product using this bootloader configuration is susceptible.

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. Attackers would need to supply a firmware image with a misleading slot arrangement, suggesting the attack vector is via the firmware update channel or supply chain. Exploitation requires the ability to write to both the main application and radio core storage areas; once achieved, the device will boot unauthenticated code during normal operation.