The vulnerability exploits a side‑channel leakage in the on‑the‑fly decryption scheme used for external QSPI flash encrypted XIP on the nRF5340. This weakness allows an attacker to recover sensitive information from the encrypted firmware, potentially exposing confidential code or altering its integrity. The weakness is identified as CWE‑1342, which covers vulnerabilities related to improper handling of cryptographic data leading to side‑channel leakage.

Nordic Semiconductor ASA’s nRF5340 SoC devices incorporating external QSPI flash for encrypted XIP. No specific nRF Connect SDK version is affected; the root cause lies in the hardware decryption process itself.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is 0.00079, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploitation yet. Based on the description, the attack likely requires physical proximity to perform power or timing measurements to exploit the side channel. Consequently, the risk is higher for environments with potential physical access by adversaries. The likelihood of exploitation remains low, but the potential impact is high if a sophisticated attacker can perform the measurements.