Cyber Resilience

CVE-2025-54520

Published
24 September 2025
Modified
15 April 2026
CVSS Score v4 8.6
Click a component to see what it means
Raw vectorCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0018 8th percentile
Risk Priority 27 floored blend · peak EPSS

Summary

CVE-2025-54520 is a high-severity Improper Protection Against Voltage and Clock Glitches (CWE-1247) vulnerability in Amd (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-18 (Tamper Resistance and Detection) and SR-9 (Tamper Resistance and Detection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platform resulting in a loss of confidentiality.

CWE(s)
CWE-1247

Related Threats

MITRE ATT&CK Enterprise Techniques

T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
attack.mitre.org →
T1553.002 Code Signing Defense Impairment
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
attack.mitre.org →
T1600 Weaken Encryption Defense Impairment
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
attack.mitre.org →
T1600.001 Reduce Key Space Defense Impairment
Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.
attack.mitre.org →
T1542 Pre-OS Boot Stealth
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
attack.mitre.org →
T1542.003 Bootkit Stealth
Adversaries may use bootkits to persist on systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-4760Shared CWE-1247

Affected Assets

Amd
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-18 Tamper Resistance and Detection good match

Tamper-resistance requirements directly drive the addition of glitch-detection circuitry and sensors that the CWE describes as missing or incorrect.

SR-9 Tamper Resistance and Detection good match

A tamper-protection program mandates hardware mechanisms that detect and respond to voltage/clock faults before they can be exploited.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-02 mostly match
prevents

Directly addresses hardware protection from environmental or physical tampering threats such as voltage/clock glitches.

ID.RA-09 partial match
prevents

Requires assessing hardware security capabilities before acquisition, indirectly catching missing glitch protections.

PR.AA-06 partial match
prevents

Limits physical access that many glitch attacks require, but does not address on-chip detection circuitry.

PR.PS-03 partial match
prevents

Ensures hardware lacking glitch-detection circuitry is replaced when risk warrants.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.5 Protecting against physical and environmental threats partial match
degrades

Physical and environmental threat controls can include hardware-level protections against voltage/clock tampering.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles can mandate glitch-detection circuitry and fault-injection countermeasures.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing in development can discover and validate protections against voltage and clock glitch attacks.

References