The flaw lies in JetPack’s system initialization logic, where an unprivileged user can force a resource to start with an insecure default. This can expose encrypted data, allow tampering of data, or trigger a partial denial of service across devices that share the same machine ID. The vulnerability is a classic case of improper configuration that breaks confidentiality, integrity and availability.

The advisory targets NVIDIA Jetson Xavier Series and Jetson Orin Series boards that run JetPack installations. Specific affected versions are not listed, so all current releases that use the original initialization routine could be compromised until a patched release is issued.

The CVSS score of 8.3 shows high severity, and although EPSS data is unavailable, the flaw is not yet in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is a local, unprivileged user able to influence the initialization code, making devices in insecure or shared environments especially vulnerable. The impact includes potential leakage of encrypted information, manipulation of system data, and limited service interruption.