External risk intelligence

NVIDIA Jetson Initialization Logic Vulnerability Allows Data Tampering and Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-24148

This vulnerability affects the system initialization logic of NVIDIA Jetson embedded hardware and developer kits. These devices are typically used in edge computing, robotics, or embedded systems and are not designed to be exposed directly to the public internet. The vulnerability requires local access or context within the specific device environment to exploit.

Information Disclosure

Nvidia Jetson Linux

before 35.6.436.0 to before 36.5

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

NVIDIA Jetson devices are affected by a critical system initialization vulnerability that could allow unauthorized access to encrypted data, data modification, and service disruptions. This issue arises from an insecure default setting during system startup.

Unprivileged access can compromise system initialization.
Potential for data breaches and service interruptions.
Confirm relevance and exposure of affected NVIDIA devices.

Attack Path

How an attacker could exploit the issue

An attacker without special privileges could exploit this vulnerability by targeting the system's initialization process on NVIDIA Jetson devices. This could involve manipulating how the system starts up, leading to the creation of a resource with weak default settings. If successful, an attacker could potentially access or alter sensitive encrypted data, or cause a partial disruption of service for other devices on the same network that share a unique machine identifier.

No special access needed to start.
Attack manipulates system initialization logic.
Risk of data exposure, tampering, or denial of service.

Live Threat

Current exploitation, exposure, and threat context

An unprivileged attacker could exploit a system initialization flaw in NVIDIA Jetson devices. This could lead to unauthorized access to encrypted data, modification of data, and partial service disruptions on devices sharing a machine ID.

System data or encrypted information.
Unprivileged local access or resource initialization.
Information disclosure or data tampering.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NVIDIA Jetson platform's system initialization logic presents a critical risk for systems where an unprivileged attacker could exploit it for data tampering, disclosure of encrypted data, or partial denial of service. Given the nature of the vulnerability, ownership likely falls to the teams managing the NVIDIA Jetson devices and the applications running on them, such as embedded systems engineers, IoT platform teams, or specialized infrastructure groups. The first crucial step is to inventory all Jetson devices, determine their network reachability and criticality, and identify the accountable owner for each device before planning remediation actions.

Identify and locate all affected Jetson devices.
Verify device reachability and business criticality.
Plan remediation with affected teams and vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NVIDIA Jetson used for?

NVIDIA Jetson is a series of embedded computing modules and developer kits used to power edge AI, robotics, and advanced machine vision applications. These devices act as the brain for intelligent systems, processing complex data locally in environments like industrial automation or autonomous vehicles. They run on a specialized version of Linux that handles hardware initialization, memory management, and secure data operations to support these performance-intensive tasks.

What does CWE-1188 mean in the context of CVE-2026-24148?

CWE-1188 refers to the 'Insecure Default Initialization of Resource' weakness class. In this case, the Jetson system startup process improperly sets up a resource with insecure defaults. Because this logic flaw occurs during initialization, an attacker can exploit the resulting weak configuration to gain unauthorized access to data or manipulate system behaviors that should have been protected by default.

How can an attacker trigger this vulnerability?

The vulnerability is triggered by manipulating the system initialization logic on the device. An unprivileged attacker can exploit this during the startup sequence to force the creation of insecurely configured resources. Note that simple, benign network interactions or routine application usage do not trigger this bug; it requires specific exploitation of the device's boot or startup configuration process to be successful.

Is my Jetson device at risk?

According to Halo Surface Signal, this vulnerability is considered very unlikely to be exposed via the public internet because Jetson hardware is typically deployed in isolated edge or embedded environments. However, if your device is inadvertently bridged to public networks or accessible to unauthorized users within your local infrastructure, the risk increases. You should evaluate your specific network architecture to determine if the device is reachable by untrusted actors.

What should I do first to address CVE-2026-24148?

Your first step is to create a comprehensive inventory of all Jetson devices in your environment to identify which systems are running the affected versions of Jetson Linux. Once identified, categorize these devices by their physical and network accessibility. Finally, locate the specific engineering or IoT teams responsible for those units to coordinate the deployment of vendor-supplied updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.