A physical side‑channel attack exploiting TPMs on Nuvoton NPCT7xx devices can allow an attacker to extract the Elliptic Curve Diffie‑Hellman (ECDH) key, which would compromise the confidentiality of any communications protected by that key and potentially enable impersonation of the device.

Nuvoton NPCT7xx controllers running firmware versions earlier than 7.2.4.0 are affected; any deployment of these devices without the recommended firmware update is vulnerable.

The CVSS score of 3.8 indicates moderate severity; the exploit requires physical proximity to the TPM and no network or remote code execution, which lowers the likelihood of widespread attacks but still poses a significant confidential impact for targeted or insider attackers; EPSS is not available and the vulnerability is not listed in KEV, so there is no known exploitation evidence to date.