How severe is CVE-2024-0148?

CVE-2024-0148 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-0148 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-0148?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-0148 have an EU (EUVD) identifier?

Yes. CVE-2024-0148 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-15947.

When was CVE-2024-0148 published?

CVE-2024-0148 was published on 2025-02-25 and last updated on 2026-06-17.

CVE-2024-0148

CVE-2024-0148 is a high-severity vulnerability with a CVSS 3.x base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-447.

Key facts

Severity: High (CVSS 3.x base score 7.6)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-15947
Weakness: CWE-447
Published: 2025-02-25
Last modified: 2026-06-17

Description

NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. The scope of the impacts can extend to other components.

Frequently asked questions

What is CVE-2024-0148?: NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. The scope of the impacts can extend to other components.
How severe is CVE-2024-0148?: CVE-2024-0148 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-0148 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-0148?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-0148 have an EU (EUVD) identifier?: Yes. CVE-2024-0148 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-15947.
When was CVE-2024-0148 published?: CVE-2024-0148 was published on 2025-02-25 and last updated on 2026-06-17.

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5617

Other CWE-447 vulnerabilities

CVE-2024-39533 — Medium (CVSS 5.8): An Unimplemented or Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on QFX5000 Series and…
CVE-2024-21607 — Medium (CVSS 5.3): An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an…

Browse all CWE-447 vulnerabilities →