CVE-2024-0148
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-0148 is a high-severity Unimplemented or Unsupported Feature in UI (CWE-447) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-6 (Security and Privacy Function Verification) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-0148 affects the UEFI firmware RCM boot mode in NVIDIA Jetson Linux and IGX OS images. The vulnerability enables an unprivileged attacker with physical access to the device to load untrusted code, which could result in code execution, escalation of privileges, data tampering, denial of service, and information disclosure. Impacts may extend to other components. It carries a CVSS v3.1 base score of 7.6 (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is linked to CWE-447.
Exploitation requires physical access to the device (AV:P) by an unprivileged attacker (PR:N) with low complexity (AC:L) and no user interaction (UI:N). Successful attacks can achieve high impacts on confidentiality, integrity, and availability, with a changed scope (S:C) potentially affecting additional components beyond the vulnerable one.
The NVIDIA security advisory provides details on mitigation and patching; refer to https://nvidia.custhelp.com/app/answers/detail/a_id/5617 for guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-15947
Vulnerability Data
NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation…
more
of privileges, data tampering, denial of service, and information disclosure. The scope of the impacts can extend to other components.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing at post-design stages directly exercises UI claims versus actual behavior and will expose unimplemented security features.
Periodic verification of security functions will reveal that a UI-advertised capability is not actually present or operating.
Requiring a documented development process and tools reduces the chance that a security feature is left unimplemented while its UI is shipped.
Mandating an SDLC that incorporates security engineering makes it less likely that advertised features remain stubs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Security tests and exercises would detect unimplemented UI features, though the control addresses broader improvement identification.
Secure SDLC practices and monitoring directly prevent stubbed security features by requiring verified implementation and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle requires that security features are actually implemented, not just presented in the UI.
A.8.26 only requires that security requirements (including resilience against attacks such as SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement or prevent the UI-misleading defect named by CWE-447 from being introduced or exploited.
Secure coding practices reduce the chance of leaving security features unimplemented.
Security testing in development and acceptance would detect unimplemented security features before release.