This vulnerability arises from a defect in NVIDIA JetPack’s system initialization routine that permits an unprivileged local user to instantiate a resource with insecure default settings. The weakness is identified as CWE‑1188, a privilege‑based resource initialization flaw. Successful exploitation can expose encrypted data, allow malicious alteration of system state, and result in a limited denial of service for all devices sharing the same machine identifier.

The flaw impacts NVIDIA Jetson devices in the Xavier and Orin families, including the AGX Xavier 32 GB, 64 GB, and industrial variants, the AGX Orin 32 GB, 64 GB, and industrial variants, the Orin Nano 4 GB, 8 GB, and Super Developer Kit, the Orin NX 8 GB, 16 GB, and the Xavier NX 8 GB, 16 GB. These systems run JetPack and JetPack Linux distributions.

With a CVSS score of 8.3, the vulnerability carries high severity, but an EPSS score of less than 1 % indicates a low current likelihood of exploitation. It is not listed in CISA’s KEV catalog. The description specifies that local, unprivileged access is required, making remote attacks unlikely. If local access is obtained, the impact spans confidentiality breach, integrity compromise, and partial availability loss across devices sharing the same identifier.